CVE-2026-25963: Fleet: Authorization Bypass in certificate template batch deletion for team administrators

February 26, 2026

A broken authorization check in Fleet’s certificate template deletion API could allow a team administrator to delete certificate templates belonging to other teams within the same Fleet instance.

References

github.com/advisories/GHSA-5jvp-m9h4-253h
github.com/fleetdm/fleet
github.com/fleetdm/fleet/commit/d27d0362db390fe835e3b5328525f25018df0fb7
github.com/fleetdm/fleet/security/advisories/GHSA-5jvp-m9h4-253h
nvd.nist.gov/vuln/detail/CVE-2026-25963

Code Behaviors & Features

Detect and mitigate CVE-2026-25963 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →