Broken access control in the host transfer API of Fleet open‑source device management allows a team maintainer to move hosts from any team into their own team, bypassing isolation boundaries. Once the host is transferred, the attacker gains full control, including executing scripts with root privileges, effectively enabling privilege escalation. The vulnerability is a classic missing authorization check, classified as CWE‑862.

Installations of FleetDM Fleet before version 4.81.1 are affected. The software is available as open‑source, and any deployment of those legacy versions is susceptible. The impact applies across all teams within an organization that use Fleet to manage hosts.

The CVSS score of 4.9 indicates moderate severity, and the EPSS score is below 1 %, meaning that exploitation probability is currently low. The vulnerability is not listed in the CISA KEV catalog. An attacker must have a team maintainer role and must invoke the host transfer API; no authenticated privilege escalation beyond team boundaries is needed. If discovered, the API call can be easily scripted, so internal malicious users or compromised accounts could exploit it.