CVE-2026-126402

CVSS 8.6 (high) · published 2026-11-13

Fleet before 4.89.0 contains an incorrect authorization flaw in its user administration API that accepts user creation or modification when the caller administers any one of the assigned teams. Authenticated team administrators can grant users administrator roles on other teams, then deploy software and execute scripts on those teams' hosts.

Weakness: CWE-863

Source: NVD CVE-2026-126402

References

• https://github.com/fleetdm/fleet/security/advisories/GHSA-mj9p-fq5h-mw8h
• https://www.vulncheck.com/advisories/fleet-before-4.89.0-broken-access-control-via-user-administration-api

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.