GO-2026-4892 A Fleet team maintainer can transfer hosts from any team via missing source team authorization in github.com/fleetdm/fleet

A Fleet team maintainer can transfer hosts from any team via missing source team authorization in github.com/fleetdm/fleet...

Missing Authorization

Overview Affected versions of this package are vulnerable to Missing Authorization in the host transfer API due to missing authorization checks on the source team. An attacker can gain unauthorized control over hosts belonging to other teams by initiating a transfer, resulting in the ability to...

PT-2026-28387

Name of the Vulnerable Software and Affected Versions Fleet versions prior to 4.81.1 Description Fleet is open source device management software. A broken access control vulnerability exists in the host transfer API. A team maintainer can transfer hosts from any team into their own team, bypassin...