{"action":"Upgrade github.com/fleetdm/fleet/v4 to 4.87.0 or later.","affected":[{"fixed":"4.87.0","introduced":"0"}],"component":"github.com/fleetdm/fleet/v4","cve_ids":["CVE-2026-48786"],"ecosystem":"Go","epss":0.00438,"exploited":false,"fixed_versions":["4.87.0"],"ghsa_id":"GHSA-88p2-jj8w-j8qg","id":"tcs_01M5KGSHRC22PVNEM0PHYA1VT6","modified_at":"2026-08-18T14:45:04.002741268Z","published_at":"2026-08-18T14:32:29Z","references":["https://osv.dev/vulnerability/GO-2026-6220","https://github.com/fleetdm/fleet/security/advisories/GHSA-88p2-jj8w-j8qg","https://github.com/fleetdm/fleet/releases/tag/fleet-v4.87.0"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"GO-2026-6220","url":"https://osv.dev/vulnerability/GO-2026-6220"}],"summary":"Fleet: Observer-class users can view team enroll secrets and credential-bearing configuration via target search endpoint in github.com/fleetdm/fleet"}