---
id: "CVE-2026-126402"
page: "https://infrastack.ai/live/CVE-2026-126402"
kind: "vulnerability"
aliases: ["CVE-2026-126402"]
title: "Fleet: team admins can grant themselves admin rights on other teams"
severity: "high"
cvss: 8.6
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "fleet", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["device-management", "fleet", "other", "self-hosted"]
not_affected_if: ["no-team-admins", "version-4.89.0-or-later"]
published_at: "2026-11-13T10:17:44+00:00"
first_seen_at: "2026-11-13T10:47:19+00:00"
updated_at: "2026-11-13T10:50:51+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-126402", "first_seen_at": "2026-11-13T10:47:19+00:00"}]
exploit_sources: []
---

# Fleet: team admins can grant themselves admin rights on other teams

Link for people: https://infrastack.ai/live/CVE-2026-126402 (this .md is for agents)

Fleet, a device management server, has an authorization flaw in its user administration API. A team administrator can create or change users so they gain admin roles on teams they do not manage, then deploy software and run scripts on those teams' hosts.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:fleet affected range not listed fixed no fixed version listed

## How to check

- Check the Fleet server version with `fleet version` and compare it with the fixed release in the fix field.
- Review which users hold team administrator roles in Fleet and whether any of them should not be able to manage other teams.

## Fix

- Fleet: move to `4.89.0` or later.

## Timeline

- 2026-11-13T10:47:19+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-126402

## Documents

- [advisory] Vendor advisory: github.com https://github.com/fleetdm/fleet/security/advisories/GHSA-mj9p-fq5h-mw8h
- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/fleet-before-4.89.0-broken-access-control-via-user-administration-api

## From the sources

Fleet before 4.89.0 contains an incorrect authorization flaw in its user administration API that accepts user creation or modification when the caller administers any one of the assigned teams. Authenticated team administrators can grant users administrator roles on other teams, then deploy software and execute scripts on those teams' hosts.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_