CVE-2026-34389

Fleet is open source device management software. Prior to 4.81.0, Fleet contained an issue in the user invitation flow where the email address provided during invite acceptance was not validated against the email address associated with the invite. An attacker who obtained a valid invite token could create an account under an arbitrary email address while inheriting the role granted by the invite, including global admin. Version 4.81.0 patches the issue.

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/fleetdm/fleet/security/advisories/GHSA-4f9r-x588-pp2h	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:fleetdm:fleet:*:*:*:*:*:*:*:*

History

26 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) Fleet es software de gestión de dispositivos de código abierto. Antes de 4.81.0, Fleet contenía un problema en el flujo de invitación de usuarios donde la dirección de correo electrónico proporcionada durante la aceptación de la invitación no se validaba contra la dirección de correo electrónico asociada con la invitación. Un atacante que obtenía un token de invitación válido podía crear una cuenta bajo una dirección de correo electrónico arbitraria mientras heredaba el rol otorgado por la invitación, incluyendo el de administrador global. La versión 4.81.0 corrige el problema.

Information

Published : 2026-03-27 20:16

Updated : 2026-10-26 21:10

NVD link : CVE-2026-34389

Mitre link : CVE-2026-34389

CVE.ORG link : CVE-2026-34389

JSON object : View

Products Affected

fleetdm

fleet

CWE

CWE-287

Improper Authentication

{"id": "CVE-2026-34389", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-34389", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-30T19:01:22.688868Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 2.8}], "cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 4.9, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "UNREPORTED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "fleetdm", "product": "fleet", "versions": [{"status": "affected", "version": "< 4.81.0"}]}]}], "published": "2026-03-27T20:16:35.957", "references": [{"url": "https://github.com/fleetdm/fleet/security/advisories/GHSA-4f9r-x588-pp2h", "tags": ["Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-287"}]}], "descriptions": [{"lang": "en", "value": "Fleet is open source device management software. Prior to 4.81.0, Fleet contained an issue in the user invitation flow where the email address provided during invite acceptance was not validated against the email address associated with the invite. An attacker who obtained a valid invite token could create an account under an arbitrary email address while inheriting the role granted by the invite, including global admin. Version 4.81.0 patches the issue."}, {"lang": "es", "value": "Fleet es software de gesti\u00f3n de dispositivos de c\u00f3digo abierto. Antes de 4.81.0, Fleet conten\u00eda un problema en el flujo de invitaci\u00f3n de usuarios donde la direcci\u00f3n de correo electr\u00f3nico proporcionada durante la aceptaci\u00f3n de la invitaci\u00f3n no se validaba contra la direcci\u00f3n de correo electr\u00f3nico asociada con la invitaci\u00f3n. Un atacante que obten\u00eda un token de invitaci\u00f3n v\u00e1lido pod\u00eda crear una cuenta bajo una direcci\u00f3n de correo electr\u00f3nico arbitraria mientras heredaba el rol otorgado por la invitaci\u00f3n, incluyendo el de administrador global. La versi\u00f3n 4.81.0 corrige el problema."}], "lastModified": "2026-10-26T21:10:00.170", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:fleetdm:fleet:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "09CFBED5-C6C2-4CCB-A48C-7E89E878E4F7", "versionEndExcluding": "4.81.1"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}