{"id":"CVE-2026-72657","title":"Authorization Bypass Through User-Controlled Key (CWE-639) in Fleet Server can lead to information disclosure via Manipulating User-Controlled Variables (CAPEC-77)","summary":"Authorization Bypass Through User-Controlled Key (CWE-639) in Fleet Server can lead to information disclosure via Manipulating User-Controlled Variables (CAPEC-77). The authorization decision for artifact downloads relied on a client-sup…","severity":"medium","cvss":6.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","cwe":["CWE-639"],"vendor":"elastic","product":"fleet_server","affected":["fleet_server >= 8.3.0, < 8.19.20","fleet_server >= 9.0.0, < 9.4.5","fleet_server = 9.5.0"],"patched":["fleet_server 9.4.5"],"published":"2026-08-13","updated":"2026-09-04","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-72657","references":[{"url":"https://discuss.elastic.co/t/fleet-server-8-19-20-9-4-5-9-5-1-security-update-esa-2026-112/389509","label":"security@elastic.co"}],"tags":["nvd"],"epss":0.00385,"epssPercentile":0.2972,"ingestedAt":"2026-09-05T18:43:14.288Z","slug":"CVE-2026-72657","body":"## Overview\n\nAuthorization Bypass Through User-Controlled Key (CWE-639) in Fleet Server can lead to information disclosure via Manipulating User-Controlled Variables (CAPEC-77). The authorization decision for artifact downloads relied on a client-supplied value that was persisted without being validated against the server-side record of the requesting agent's assignment. An authenticated party in possession of a valid enrolled agent credential could therefore retrieve a policy the agent is not assigned to.\n\n## Affected\n\n- `fleet_server >= 8.3.0, < 8.19.20`\n- `fleet_server >= 9.0.0, < 9.4.5`\n- `fleet_server = 9.5.0`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `fleet_server 9.4.5`","depth":"sunlit","depthScore":36,"depthScoreParts":{"impact":35.8,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}