The flaw in Fleet's invitation workflow allows an attacker who has a valid invitation token to create a new user account with any e-mail address. The system does not verify that the e-mail supplied upon acceptance matches the e-mail bound to the invite, so the new account inherits the inviter's role, which can be Global Admin. This creates an Authentication Bypass (CWE-287) that can lead to administrative access to the entire Fleet deployment.

The vulnerability affects the open-source device‑ platform Fleet, developed by fleetdm. Versions released prior to 4.81.0 are vulnerable. Reducing exposure requires applying the patch that accompanies release 4.81.0 or newer.

The CVSS score of 4.9 indicates moderate severity. While no EPSS score is available and the vulnerability is not listed in CISA's KEV catalog, exploitation requires a valid invite token, which an adversary may obtain through social engineering or by reusing a captured token. With the token, the attacker can create a fully privileged account, so the risk is significant for environments that issue Global Admin privileges.