CVE-2026-111654
CVE-2026-111654 · FastBee through 2.1.0 IDOR via /iot/group By-ID Endpoints
Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.
FastBee through 2.1.0 contains an insecure direct object reference vulnerability that allows authenticated low-privilege users to access other users' device groups because GroupController queries lack owner checks. Attackers, including self-registered users, can supply sequential group IDs to read, overwrite, reassign, rewrite device associations of, or delete other users' groups.
CVSS 5.3 · Media · EPSS 0,3%
- Publicación
- Actualización
Productos y versiones afectados
fastbee
- Versiones
- ≥ 0, ≤ 2.1.0: Afectada (semver)
Sin corrección publicada
Fuentes originales
- https://hackmd.io/@hieuPenguinnn/fastbee-device-group-cross-user-idor
- https://github.com/kerwincui/FastBee/blob/v2.1.0/springboot/fastbee-open-api/src/main/java/com/fastbee/data/controller/GroupController.java#L70-L137
- https://github.com/kerwincui/FastBee/blob/v2.1.0/springboot/fastbee-service/fastbee-iot-service/src/main/java/com/fastbee/iot/service/impl/GroupServiceImpl.java#L37-L143
- https://github.com/kerwincui/FastBee/blob/v2.1.0/springboot/fastbee-service/fastbee-iot-service/src/main/resources/mapper/iot/GroupMapper.xml#L36-L109
- https://www.vulncheck.com/advisories/fastbee-through-2.1.0-idor-via-iot-group-by-id-endpoints
- https://nvd.nist.gov/vuln/detail/CVE-2026-111654