CVE-2026-126402: Fleet before 4.89.0 Broken Access Control via User Administration API
Fleet before 4.89.0 contains an incorrect authorization flaw in its user administration API that accepts user creation or modification when the caller administers any one of the assigned teams. Authenticated team administrators can grant users administrator roles on other teams, then deploy software and execute scripts on those teams' hosts.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated Fleet user who is an administrator of at least one team can exploit the affected user administration API. The attacker does not need to already administer the teams they target.
What access can an attacker gain through exploitation?
The attacker can assign administrator roles to users on other teams. They can then deploy software and execute scripts on hosts belonging to those teams.
Which deployments are affected?
Fleet versions before 4.89.0 are affected. The provided information does not identify any configuration requirement beyond having team administration access and access to the user administration API.
How can I determine whether abuse may have occurred?
Review user creation and modification activity for administrator-role assignments on teams where the caller was not already an administrator. Also investigate subsequent software deployments or script executions on those teams' hosts.