CVE-2026-110124 FastBee through 2.1.0 IDOR via DeviceController /iot/device Endpoints
Authenticated low-privilege users can read and modify other tenants' IoT devices by manipulating device IDs in FastBee.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-110124?
CVE-2026-110124 is a high-severity missing authorization vulnerability in kerwincui FastBee, published on 13 Oct 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
FastBee through 2.1.0 contains an insecure direct object reference vulnerability in DeviceController that allows authenticated low-privilege users to read and modify other tenants' devices by supplying sequential device IDs. Self-registered attackers can enumerate deviceId or serialNumber values to read owner, IP, and location data, and overwrite user_id and tenant_id to take over devices.
Weakness: CWE-639
Which versions are affected by CVE-2026-110124?
How do I fix CVE-2026-110124?
No fix has been published for CVE-2026-110124 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-110124 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-110124 exists.
Sources
Also known as GHSA-pv4m-4fcw-r33m.