CVE-2022-24841 Improper Authorization in github.com/fleetdm/fleet

Medium 6.5 Published 18 Apr 2022 Updated 23 Apr 2025

A team admin can improperly add themselves to other teams, escalating privileges in Fleet instances using the teams feature.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2022-24841?

CVE-2022-24841 is a medium-severity missing authorization vulnerability in fleetdm fleet, published on 18 Apr 2022. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

fleetdm/fleet is an open source device management, built on osquery. All versions of fleet making use of the teams feature are affected by this authorization bypass issue. Fleet instances without teams, or with teams but without restricted team accounts are not affected. In affected versions a team admin can erroneously add themselves as admin, maintainer or observer on other teams. Users are advised to upgrade to version 4.13. There are no known workarounds for this issue.

Weakness: CWE-863, CWE-284

Which versions are affected by CVE-2022-24841?

It affects 1 product.

Products include Fleetdm Fleet.

How do I fix CVE-2022-24841?

No fix has been published for CVE-2022-24841 yet. Limit exposure of the affected software until one is available.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2022-24841 being exploited?

There is no known exploitation of CVE-2022-24841 in the wild and no public exploit code.

Sources

Also known as GHSA-pr2g-j78h-84cr, UBUNTU-CVE-2022-24841.