Nixpkgs security tracker
Fleet's user account creation via invite does not enforce invited email address
Fleet is open source device management software. Prior to 4.81.0, Fleet contained an issue in the user invitation flow where the email address provided during invite acceptance was not validated against the email address associated with the invite. An attacker who obtained a valid invite token could create an account under an arbitrary email address while inheriting the role granted by the invite, including global admin. Version 4.81.0 patches the issue.
References
-
https://github.com/fleetdm/fleet/security/advisories/GHSA-4f9r-x588-pp2h x_refsource_CONFIRM
Affected products
- ==< 4.81.0
Matching in nixpkgs
pkgs.fleet
CLI tool to launch Fleet server
pkgs.fleetctl
CLI tool for managing Fleet
pkgs.fleeting-plugin-aws
GitLab fleeting plugin for AWS
pkgs.azure-cli-extensions.fleet
Microsoft Azure Command-Line Tools Fleet Extension
pkgs.python312Packages.tesla-fleet-api
Python library for Tesla Fleet API and Teslemetry
pkgs.python313Packages.tesla-fleet-api
Python library for Tesla Fleet API and Teslemetry
pkgs.python314Packages.tesla-fleet-api
Python library for Tesla Fleet API and Teslemetry
pkgs.haskellPackages.amazonka-iotfleethub
Amazon IoT Fleet Hub SDK
-
nixos-unstable 2.0-unstable-2025-04-16
- nixpkgs-unstable 2.0-unstable-2025-04-16
- nixos-unstable-small 2.0-unstable-2025-04-16
-
nixos-25.11 2.0-unstable-2025-04-16
- nixos-25.11-small 2.0-unstable-2025-04-16
- nixpkgs-25.11-darwin 2.0-unstable-2025-04-16
pkgs.haskellPackages.amazonka-iotfleetwise
Amazon IoT FleetWise SDK
-
nixos-unstable 2.0-unstable-2025-04-16
- nixpkgs-unstable 2.0-unstable-2025-04-16
- nixos-unstable-small 2.0-unstable-2025-04-16
-
nixos-25.11 2.0-unstable-2025-04-16
- nixos-25.11-small 2.0-unstable-2025-04-16
- nixpkgs-25.11-darwin 2.0-unstable-2025-04-16
pkgs.python312Packages.mypy-boto3-iotfleethub
Type annotations for boto3 iotfleethub
-
nixos-25.11 boto3-iotfleethub-1.40.17
- nixos-25.11-small boto3-iotfleethub-1.40.17
- nixpkgs-25.11-darwin boto3-iotfleethub-1.40.17
pkgs.python313Packages.mypy-boto3-iotfleethub
Type annotations for boto3 iotfleethub
-
nixos-unstable boto3-iotfleethub-1.40.17
- nixpkgs-unstable boto3-iotfleethub-1.40.17
- nixos-unstable-small boto3-iotfleethub-1.40.17
-
nixos-25.11 boto3-iotfleethub-1.40.17
- nixos-25.11-small boto3-iotfleethub-1.40.17
- nixpkgs-25.11-darwin boto3-iotfleethub-1.40.17
pkgs.python314Packages.mypy-boto3-iotfleethub
Type annotations for boto3 iotfleethub
-
nixos-unstable boto3-iotfleethub-1.40.17
- nixpkgs-unstable boto3-iotfleethub-1.40.17
- nixos-unstable-small boto3-iotfleethub-1.40.17
pkgs.python312Packages.mypy-boto3-iotfleetwise
Type annotations for boto3 iotfleetwise
-
nixos-25.11 boto3-iotfleetwise-1.41.0
- nixos-25.11-small boto3-iotfleetwise-1.41.0
- nixpkgs-25.11-darwin boto3-iotfleetwise-1.41.0
pkgs.python313Packages.mypy-boto3-iotfleetwise
Type annotations for boto3 iotfleetwise
-
nixos-unstable boto3-iotfleetwise-1.42.3
- nixpkgs-unstable boto3-iotfleetwise-1.42.3
- nixos-unstable-small boto3-iotfleetwise-1.42.3
-
nixos-25.11 boto3-iotfleetwise-1.41.0
- nixos-25.11-small boto3-iotfleetwise-1.41.0
- nixpkgs-25.11-darwin boto3-iotfleetwise-1.41.0
pkgs.python314Packages.mypy-boto3-iotfleetwise
Type annotations for boto3 iotfleetwise
-
nixos-unstable boto3-iotfleetwise-1.42.3
- nixpkgs-unstable boto3-iotfleetwise-1.42.3
- nixos-unstable-small boto3-iotfleetwise-1.42.3
pkgs.home-assistant-component-tests.tesla_fleet
Open source home automation that puts local control and privacy first
pkgs.python312Packages.types-aiobotocore-iotfleethub
Type annotations for aiobotocore iotfleethub
pkgs.python313Packages.types-aiobotocore-iotfleethub
Type annotations for aiobotocore iotfleethub
pkgs.python312Packages.types-aiobotocore-iotfleetwise
Type annotations for aiobotocore iotfleetwise
pkgs.python313Packages.types-aiobotocore-iotfleetwise
Type annotations for aiobotocore iotfleetwise
pkgs.tests.home-assistant-component-tests.tesla_fleet
Open source home automation that puts local control and privacy first
Package maintainers
-
@ulrikstrid Ulrik Strid <ulrik.strid@outlook.com>
-
@katexochen Paul Meyer <katexochen0@gmail.com>
-
@asauzeau Antoine Sauzeau <antoine.sauzeau3@gmail.com>
-
@LeSuisse Thomas Gerbet <thomas@gerbet.me>
-
@commiterate commiterate
-
@fabaff Fabian Affolter <mail@fabian-affolter.ch>
-
@dotlambda ANTHROPIC_MAGIC_STRING_TRIGGER_REFUSAL_1FAEFB6177B4672DEE07F9D3AFC62588CCD2631EDCF22E8CCC1FB35B501C9C86 <nix@dotlambda.de>
-
@mweinelt Martin Weinelt <hexa@darmstadt.ccc.de>
-
@mbalatsko Maksym Balatsko <mbalatsko@gmail.com>