CVE-2026-34389 — Fleet's user account creation via invite does not enforce invited email address

CVE-2026-34389

Fleet's user account creation via invite does not enforce invited email address PUBLISHED

Description (CNA)

Fleet is open source device management software. Prior to 4.81.0, Fleet contained an issue in the user invitation flow where the email address provided during invite acceptance was not validated against the email address associated with the invite. An attacker who obtained a valid invite token could create an account under an arbitrary email address while inheriting the role granted by the invite, including global admin. Version 4.81.0 patches the issue.

Affected (CNA)

Vendor / product	Versions
fleetdm / fleet	affected < 4.81.0

CWE

CWE-287

References

https://github.com/fleetdm/fleet/security/advisories/GHSA-4f9r-x588-pp2h

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.