Fleet EUVD-2026-16797

While CVSS scoring data is not available, the vulnerability presents significant real-world risk based on its technical characteristics and attack feasibility. The attack requires only a valid invite token-a moderate requirement for an external attacker but trivial for insiders or users with social engineering capability. The impact is severe: an attacker can obtain global admin privileges in a device management platform, enabling full control over organizational fleet data, configurations, and potentially deployed security controls. CWE-287 (Improper Authentication) is a foundational control bypass category that typically results in high exploitability in SSVC analysis. The fact that this affects role inheritance, including admin roles, elevates it beyond simple account takeover to privilege escalation. The absence of CVSS vector data and EPSS scoring prevents precise comparison, but the combination of unauthenticated access post-invitation, high impact (admin privilege escalation), and straightforward exploitation mechanics suggests this should be treated as a critical priority for all organizations running affected Fleet versions.

An attacker obtains a valid Fleet user invitation token intended for a legitimate employee (e.g., through email interception, social engineering, or insider access). Rather than using their own email to accept the invite, the attacker navigates to the Fleet invitation acceptance page and enters an attacker-controlled email address instead. Due to the missing validation, the application creates an account with the attacker's email while granting the role permissions attached to the original invite. If the invite was generated for an admin role, the attacker now has global administrator access to the Fleet device management system, allowing full control over organizational endpoints and security policies. No technical exploit code has been publicly released, but the vulnerability is straightforward to execute and requires only basic web request manipulation.