Fleet’s host transfer API contains a broken access control flaw that allows a user with team maintainer privileges to move any host from any team into their own team. After the transfer, the maintainer acquires full control of the host, including the ability to run scripts with root privileges. This violation of team isolation boundaries is a classic example of improper authorization (CWE‑862).

The issue exists in Fleet versions prior to 4.81.1; upgrading to 4.81.1 or later resolves the vulnerability. The affected product is the Fleet device‑management platform developed by fleetdm.

The CVSS base score of 4.9 indicates moderate severity, but the potential impact is high because the attacker gains root access to any host they transfer. Exploitation requires only legitimate or compromised team‑maintainer credentials and the normal API usage surface; no additional network exposure is necessary. The EPSS score is unavailable, and the vulnerability is not listed in the CISA KEV catalog, implying limited public exploitation data but a substantial risk to organizations that rely on strict team isolation.