GHSA-q9c5-pp7m-fm2g: Fleet: Unauthenticated download of in-house iOS app binaries via predictable URLs

August 20, 2026

Two endpoints serving in-house iOS application packages and manifests in Fleet’s enterprise tier are reachable without a hard-to-guess token in the URL, allowing an unauthenticated attacker who can reach the Fleet server to download an in-house IPA by guessing sequential title identifiers.

References

github.com/advisories/GHSA-q9c5-pp7m-fm2g
github.com/fleetdm/fleet/releases/tag/fleet-v4.87.0
github.com/fleetdm/fleet/security/advisories/GHSA-q9c5-pp7m-fm2g

Code Behaviors & Features

Detect and mitigate GHSA-q9c5-pp7m-fm2g with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →