CyberRota Analysis
AI-GeneratedThe vulnerability allows an authenticated user with valid credentials to bypass authorization controls in Fleet Server, enabling them to access and download policies they are not assigned to by manipulating user-controlled variables. This could lead to unauthorized information disclosure, posing a risk to organizations relying on Fleet Server for policy management. Organizations using Fleet Server should prioritize addressing this issue to safeguard sensitive policy information from unauthorized access.
Original NVD Description
Authorization Bypass Through User-Controlled Key (CWE-639) in Fleet Server can lead to information disclosure via Manipulating User-Controlled Variables (CAPEC-77). The authorization decision for artifact downloads relied on a client-supplied value that was persisted without being validated against the server-side record of the requesting agent's assignment. An authenticated party in possession of a valid enrolled agent credential could therefore retrieve a policy the agent is not assigned to.