Broken Authorization Check in Fleet Device Management Software

CVE-2026-25963

What is CVE-2026-25963?

Fleet, an open-source device management solution, suffers from a vulnerability in its certificate template deletion API that allows team administrators to inadvertently delete certificate templates belonging to other teams. This flaw arises because the API's batch deletion endpoint did not adequately validate that the user-supplied team identifier matched the actual certificate templates being deleted. Consequently, an administrator could disrupt critical services reliant on those templates—such as device enrollment and VPN access—by removing certificates created by other teams. Although this vulnerability does not lead to privilege escalation or access to sensitive data, it jeopardizes the integrity and availability of certificate-based operations. Version 4.80.1 includes a fix for this issue, and administrators are advised to limit template management permissions to trusted users until they can upgrade.

References