CVE-2026-0653 Insecure Access Control on TP-Link Tapo D235 and C260
Guest users can bypass access controls to modify protected device settings on TP-Link Tapo cameras and doorbells.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-0653?
CVE-2026-0653 is a high-severity missing authorization vulnerability in TP-Link Systems Inc. Tapo C260 v1, published on 10 Feb 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
On TP-Link Tapo C260 v1 and D235 v1, a guest‑level authenticated user can bypass intended access restrictions by sending crafted requests to a synchronization endpoint. This allows modification of protected device settings despite limited privileges. An attacker may change sensitive configuration parameters without authorization, resulting in unauthorized device state manipulation but not full code execution.
Weakness: CWE-284
Which versions are affected by CVE-2026-0653?
It affects 1 product.
Products include Tp-Link Tapo C260 Firmware.
How do I fix CVE-2026-0653?
No fix has been published for CVE-2026-0653 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-0653 being exploited?
There is no known exploitation of CVE-2026-0653 in the wild and no public exploit code.
Other vulnerabilities in TP-Link Systems Inc. Tapo C260 v1
Sources
Also known as GHSA-ghg5-7pjg-pp65.