Fleet’s invitation flow allows an attacker who possesses a valid invitation token to create a new user account under any email address, bypassing the intended match between the token’s pre‑allocated email and the one entered upon acceptance. The resulting account inherits the role specified in the invitation, which may include global administrator rights. This flaw is an authentication bypass that can grant an attacker full control over the Fleet deployment.

The vulnerability exists in the open‑source Fleet device‑management platform from fleetdm. All releases before version 4.81.0 are affected; upgrading to 4.81.0 or later applies the fix. No other versions are impacted.

The CVSS base score of 4.9 indicates moderate severity, while the EPSS score of less than 1 % shows low likelihood of widespread exploitation. The issue is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation requires an attacker to obtain a valid invitation token; the advisory implies that the token may be acquired or guessed, but it does not detail the exact mechanism. Attackers with such a token can create a privileged account and potentially compromise the entire fleet.