CVE-2026-46371: Fleet: Observer-level enrollment secret extraction via ORDER BY oracle on Apple MDM commands endpoint

A vulnerability in Fleet’s Apple MDM commands listing endpoint allowed authenticated users with the lowest-privilege Observer role to extract sensitive values from joined database tables — including host enrollment secrets and Apple Push Notification Service (APNS) tokens — through a cursor-based binary search oracle. The endpoint accepted a user-supplied order_key parameter that was not validated against a column allowlist.