CVE-2026-34389 is an improper authentication vulnerability (CWE-287) in Fleet versions before 4.81.0. The flaw occurs because the software does not verify that the email address used to accept an invitation matches the email address originally invited. Consequently, an attacker who obtains a valid invite token can register an account under a different email address and gain the associated role permissions, potentially including global administrator access. This issue is resolved in Fleet version 4.81.0.

An attacker with a valid invite token can bypass intended email validation controls and create an account with arbitrary email addresses, inheriting the role assigned by the invite. This can lead to unauthorized privilege escalation, including gaining global administrator rights. The CVSS 4.0 base score is 4.9 (medium severity), reflecting network attack vector, low attack complexity, no user interaction, and high impact on integrity.

Upgrade Fleet to version 4.81.0 or later, where this authentication flaw is patched. Since this is a self-hosted product, administrators must apply the update themselves. Patch status is confirmed by the vendor advisory stating the issue is fixed in 4.81.0. No additional mitigations are indicated.