CVE-2026-110124 Details

A vulnerability allowing insecure direct object reference (IDOR) has been identified in the FastBee IoT platform, specifically in the DeviceController of the wumei-iot module, affecting versions through 2.1.0. This vulnerability allows authenticated low-privilege users to read and modify devices belonging to other tenants by manipulating device IDs. The issue arises because the device read and write endpoints do not verify device ownership, enabling users to access and alter device information across different accounts.

The vulnerability can be addressed by implementing proper ownership checks in the DeviceController's read and update endpoints. This involves verifying that the authenticated user is the owner of the device before allowing access or modifications. Additionally, removing the ability to overwrite user and tenant IDs during device updates can prevent unauthorized ownership transfers.