High severity · published Apr 18, 2022
CVE-2022-24841
fleetdm/fleet is an open source device management, built on osquery
8.1
CVSS
0.8%
EPSS
No
On KEV
Description
fleetdm/fleet is an open source device management, built on osquery. All versions of fleet making use of the teams feature are affected by this authorization bypass issue. Fleet instances without teams, or with teams but without restricted team accounts are not affected. In affected versions a team admin can erroneously add themselves as admin, maintainer or observer on other teams. Users are advised to upgrade to version 4.13. There are no known workarounds for this issue.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.8% · higher than 58% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FL
Fleet · Fleetdm
before 4.13 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-24841
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-24841
Patch
https://github.com/fleetdm/fleet/commit/da171d3b8d149c30b8307723cbe6b6e8847cb30c
Third Party Advisory
https://github.com/fleetdm/fleet/security/advisories/GHSA-pr2g-j78h-84cr
More from Fleet
9.8
CVE-2026-26191
Fleet vulnerable to OS command injection in software packages
9.8
CVE-2026-34387
Fleet vulnerable to OS command injection via crafted software package metadata in uninstall scripts
9.8
CVE-2026-23518
Fleet has a JWT signature bypass vulnerability in Azure AD MDM enrollment
9.8
CVE-2020-26276
Fleet is an open source osquery manager
9.3
CVE-2025-27509
SAML authentication vulnerability due to improper SAML response validation