## Summary
Fixes a security issue where `POST /api/latest/fleet/targets` returned
sensitive fleet configuration to users with insufficient privileges.
Other team-facing endpoints apply proper access controls; the target
search path did not.
- Replaces the `teamSearchResult` struct with a slim version containing
only the non-sensitive fields documented in the API response (`id`,
`created_at`, `name`, `description`, `user_count`, `host_count`,
`display_text`, `count`).
- Removes the `MarshalJSON`/`UnmarshalJSON` methods (~70 lines) that
serialized fields the target picker never uses.
- Verified that no frontend component, fleetctl client, or integration
test reads sensitive fields from the target search response.
- Validated the response shape matches the documented API contract in
`docs/REST API/rest-api.md`.
Closesfleetdm/confidential#16054
Related advisory: GHSA-88p2-jj8w-j8qg
## How we reproduced
1. Started local dev server (`fleet serve --dev --dev_license`)
2. Created a global observer user and a saved query with
`observer_can_run = true`
3. Logged in as the observer
**Before fix** -- same observer session, same team:
```
GET /api/latest/fleet/fleets/2/secrets
-> secret: "********" (correctly masked)
POST /api/latest/fleet/targets {"query":"","query_id":7,"selected":{"hosts":[],"labels":[],"teams":[]}}
-> sensitive configuration leaked for all teams
```
**After fix** -- rebuilt binary, restarted server, same observer:
```
GET /api/latest/fleet/fleets/2/secrets
-> secret: "********" (unchanged)
POST /api/latest/fleet/targets (same request)
-> only non-sensitive fields returned (id, name, display_text, count, etc.)
```
Also verified admin target search still returns team metadata correctly.
## Test plan
- [x] Manual reproduction on local dev server
- [x] Manual verification after fix
- [x] Admin target search still returns team metadata (id, name,
host_count, display_text)
- [x] Verified no consumers (frontend, fleetctl, tests) read sensitive
fields from target search
- [x] Validated response matches documented API contract in `docs/REST
API/rest-api.md`
- [x] Unit test verifies response contains only documented non-sensitive
fields
- [x] `go test ./server/service/ -run TestSearchTargets` passes
- [ ] CI passes
Sharon Katz
6a481477e8