CVE-2026-126402

Versions of Fleet before 4.89.0 are vulnerable to a broken access control flaw within the user administration API . The root cause is an incorrect authorization check that allows the API to accept user creation or modification requests if the caller administers at least one assigned team. Exploit...

EUVD-2026-125163

Fleet before 4.89.0 contains an incorrect authorization flaw in its user administration API that accepts user creation or modification when the caller administers any one of the assigned teams. Authenticated team administrators can grant users administrator roles on other teams, then deploy...