Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-5zgg-t22h-v3ea
Vulnerability ID VCID-5zgg-t22h-v3ea
Aliases CVE-2026-34389
GHSA-4f9r-x588-pp2h
Summary Fleet is open source device management software. Prior to 4.81.0, Fleet contained an issue in the user invitation flow where the email address provided during invite acceptance was not validated against the email address associated with the invite. An attacker who obtained a valid invite token could create an account under an arbitrary email address while inheriting the role granted by the invite, including global admin. Version 4.81.0 patches the issue.
Status Published
Exploitability None
Weighted Severity None
Risk None
Affected and Fixed Packages Package Details
Weaknesses (1)
CWE-287 Improper Authentication
System Score Found at
epss 0.00042 https://api.first.org/data/v1/epss?cve=CVE-2026-34389
epss 0.00042 https://api.first.org/data/v1/epss?cve=CVE-2026-34389
epss 0.00042 https://api.first.org/data/v1/epss?cve=CVE-2026-34389
epss 0.00042 https://api.first.org/data/v1/epss?cve=CVE-2026-34389
cvssv4 4.9 https://github.com/fleetdm/fleet
generic_textual MODERATE https://github.com/fleetdm/fleet
cvssv4 4.9 https://github.com/fleetdm/fleet/security/advisories/GHSA-4f9r-x588-pp2h
generic_textual MODERATE https://github.com/fleetdm/fleet/security/advisories/GHSA-4f9r-x588-pp2h
ssvc Track https://github.com/fleetdm/fleet/security/advisories/GHSA-4f9r-x588-pp2h
cvssv4 4.9 https://nvd.nist.gov/vuln/detail/CVE-2026-34389
generic_textual MODERATE https://nvd.nist.gov/vuln/detail/CVE-2026-34389
Reference id Reference type URL
https://api.first.org/data/v1/epss?cve=CVE-2026-34389
https://github.com/fleetdm/fleet
https://nvd.nist.gov/vuln/detail/CVE-2026-34389
GHSA-4f9r-x588-pp2h https://github.com/fleetdm/fleet/security/advisories/GHSA-4f9r-x588-pp2h
No exploits are available.
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U Found at https://github.com/fleetdm/fleet
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U Found at https://github.com/fleetdm/fleet/security/advisories/GHSA-4f9r-x588-pp2h
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-03-30T19:01:22Z/ Found at https://github.com/fleetdm/fleet/security/advisories/GHSA-4f9r-x588-pp2h
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U Found at https://nvd.nist.gov/vuln/detail/CVE-2026-34389
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.12995
EPSS Score 0.00042
Published At June 11, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-06-11T16:47:17.287327+00:00 Vulnrichment Import https://github.com/cisagov/vulnrichment/blob/develop/2026/34xxx/CVE-2026-34389.json 38.6.0