CVE-2022-24841

HighCVSS 8.1/10Last modified Jun 17, 2026

Description

fleetdm/fleet is an open source device management, built on osquery. All versions of fleet making use of the teams feature are affected by this authorization bypass issue. Fleet instances without teams, or with teams but without restricted team accounts are not affected. In affected versions a team admin can erroneously add themselves as admin, maintainer or observer on other teams. Users are advised to upgrade to version 4.13. There are no known workarounds for this issue.

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-284 CWE-863

Affected software

Vendor	Product	Versions
fleetdm	fleet	< 4.13

References

https://github.com/fleetdm/fleet/commit/da171d3b8d149c30b8307723cbe6b6e8847cb30cPatch, Third Party Advisory
https://github.com/fleetdm/fleet/security/advisories/GHSA-pr2g-j78h-84crThird Party Advisory
https://github.com/fleetdm/fleet/commit/da171d3b8d149c30b8307723cbe6b6e8847cb30cPatch, Third Party Advisory
https://github.com/fleetdm/fleet/security/advisories/GHSA-pr2g-j78h-84crThird Party Advisory

Timeline

Published: Apr 18, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-248428.8MinIO is a High Performance Object Storage released under GNU Affero General Public License v3.0. A security issue was found where an non-ad CVE-2022-248437.5Gin-vue-admin is a backstage management system based on vue and gin, which separates the front and rear of the full stack. Gin-vue-admin 2.5 CVE-2022-248448.8Gin-vue-admin is a backstage management system based on vue and gin, which separates the front and rear of the full stack. The problem occur CVE-2022-248459.8Vyper is a pythonic Smart Contract Language for the ethereum virtual machine. In affected versions, the return of `<iface>.returns_int128()`CVE-2022-248467.2GeoWebCache is a tile caching server implemented in Java. The GeoWebCache disk quota mechanism can perform an unchecked JNDI lookup, which i CVE-2022-248477.2GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. The GeoServer security mech CVE-2022-248488.8DHIS2 is an information system for data capture, management, validation, analytics and visualization. A SQL injection security vulnerability CVE-2022-248496.5DisCatSharp is a Discord API wrapper for .NET. Users of versions 9.8.5, 9.8.6, 9.9.0 and previously published prereleases of 10.0.0 who have CVE-2022-24857.5Any attempt (good or bad) to log into AutomationDirect Stride Field I/O with a web browser may result in the device responding with its pass CVE-2022-248504.3Discourse is an open source platform for community discussion. A category's group permissions settings can be viewed by anyone that has acce CVE-2022-248514.8LDAP Account Manager (LAM) is an open source web frontend for managing entries stored in an LDAP directory. The profile editor tool has an e CVE-2022-248535.3Metabase is an open source business intelligence and analytics application. Metabase has a proxy to load arbitrary URLs for JSON maps as par