{"id":"CVE-2026-126402","kind":"vulnerability","aliases":["CVE-2026-126402"],"related":[],"title":"Fleet: team admins can grant themselves admin rights on other teams","description":"Fleet before 4.89.0 contains an incorrect authorization flaw in its user administration API that accepts user creation or modification when the caller administers any one of the assigned teams. Authenticated team administrators can grant users administrator roles on other teams, then deploy software and execute scripts on those teams' hosts.","summary":"Fleet, a device management server, has an authorization flaw in its user administration API. A team administrator can create or change users so they gain admin roles on teams they do not manage, then deploy software and run scripts on those teams' hosts.","severity":"high","cvss":8.6,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"fleet","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["device-management","fleet","other","self-hosted"],"not_affected_if":["no-team-admins","version-4.89.0-or-later"],"how_to_check":"- Check the Fleet server version with `fleet version` and compare it with the fixed release in the fix field.\n- Review which users hold team administrator roles in Fleet and whether any of them should not be able to manage other teams.","fix":"- Fleet: move to `4.89.0` or later.","status":"open","published_at":"2026-11-13T10:17:44+00:00","first_seen_at":"2026-11-13T10:47:19+00:00","triaged_at":"2026-11-13T10:50:51+00:00","updated_at":"2026-11-13T10:50:51+00:00","category":"other","confidence":0.75,"triage":{"at":"2026-11-13T10:50:51Z","model":"claude-haiku-5-5","output":{"fix":"- Fleet: move to `4.89.0` or later.","reach":"network","title":"Fleet: team admins can grant themselves admin rights on other teams","impact":"high","summary":"Fleet, a device management server, has an authorization flaw in its user administration API. A team administrator can create or change users so they gain admin roles on teams they do not manage, then deploy software and run scripts on those teams' hosts.","audience":"businesses","category":"other","nicknames":[],"who_cares":["fleet","self-hosted","device-management"],"confidence":0.75,"fix_status":"available","needs_auth":"yes","worst_case":"Team admin gains admin rights elsewhere and runs scripts on hosts","analyst_note":"","how_to_check":"- Check the Fleet server version with `fleet version` and compare it with the fixed release in the fix field.\n- Review which users hold team administrator roles in Fleet and whether any of them should not be able to manage other teams.","plain_action":"","product_name":"fleet","needs_analyst":false,"not_affected_if":["version-4.89.0-or-later","no-team-admins"],"who_is_affected":"Teams running self-hosted or cloud Fleet servers before 4.89.0 that have more than one team and grant team administrator roles. Exposure requires an authenticated account with admin rights on at least one team. Single-team deployments with no team administrators are less exposed.","user_interaction":"no","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000722,"input_tokens":4591,"output_tokens":525,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-126402':14A,17A '-2026':13A,16A '4.89.0':72C 'accept':84C 'admin':3A,7A,52B 'administ':92C 'administr':39B,43B,81C,101C,105C 'api':40B,82C 'assign':97C 'authent':99C 'author':34B,76C 'caller':91C 'chang':47B 'contain':73C 'creat':45B 'creation':86C 'cve':12A,15A 'deploy':61B,111C 'devic':20B,29B 'device-manag':19B 'execut':114C 'flaw':35B,77C 'fleet':1A,18A,22B,27B,70C 'gain':51B 'grant':5A,103C 'host':26B,69B,119C 'incorrect':75C 'manag':21B,30B,59B 'modif':88C 'one':94C 'right':8A 'role':53B,106C 'run':64B 'script':65B,115C 'self':25B 'self-host':24B 'server':31B 'softwar':62B,112C 'team':2A,11A,42B,55B,68B,98C,100C,109C,118C 'user':38B,48B,80C,85C,104C","nicknames":[],"mitigations":[],"who_affected":"Teams running self-hosted or cloud Fleet servers before 4.89.0 that have more than one team and grant team administrator roles. Exposure requires an authenticated account with admin rights on at least one team. Single-team deployments with no team administrators are less exposed.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["fleet"],"ptokens":["fleet"],"labels":["devicemanagement","fleet","high","other","selfhosted","vendor"],"campaign_type":null,"search_a":"'-126402':14A,17A '-2026':13A,16A 'admin':3A,7A 'cve':12A,15A 'fleet':1A,18A 'grant':5A 'right':8A 'team':2A,11A","search_b":"'admin':52B 'administr':39B,43B 'api':40B 'author':34B 'chang':47B 'creat':45B 'deploy':61B 'devic':20B,29B 'device-manag':19B 'flaw':35B 'fleet':22B,27B 'gain':51B 'host':26B,69B 'manag':21B,30B,59B 'role':53B 'run':64B 'script':65B 'self':25B 'self-host':24B 'server':31B 'softwar':62B 'team':42B,55B,68B 'user':38B,48B","search_c":"'4.89.0':72C 'accept':84C 'administ':92C 'administr':81C,101C,105C 'api':82C 'assign':97C 'authent':99C 'author':76C 'caller':91C 'contain':73C 'creation':86C 'deploy':111C 'execut':114C 'flaw':77C 'fleet':70C 'grant':103C 'host':119C 'incorrect':75C 'modif':88C 'one':94C 'role':106C 'script':115C 'softwar':112C 'team':98C,100C,109C,118C 'user':80C,85C,104C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-10-28T19:33:52+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126402","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126402","severity":null,"published_at":"2026-11-13T10:17:44+00:00","modified_at":"2026-11-13T10:17:44+00:00","first_seen_at":"2026-11-13T10:47:19+00:00","fetched_at":"2026-11-13T10:47:19+00:00","note":null}],"documents":[{"id":145047,"url":"https://github.com/fleetdm/fleet/security/advisories/GHSA-mj9p-fq5h-mw8h","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-28T19:33:52+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":145048,"url":"https://www.vulncheck.com/advisories/fleet-before-4.89.0-broken-access-control-via-user-administration-api","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}