CVE-2026-111654 Details

A vulnerability allowing insecure direct object reference has been identified in FastBee versions through 2.1.0. This issue enables authenticated low-privilege users to access and manipulate other users' device groups. The vulnerability arises because the GroupController does not enforce owner checks in its queries. Attackers can exploit this by supplying sequential group IDs to read, overwrite, reassign, or delete groups belonging to other users. The flaw is present in the device group management module of the application.

To address this vulnerability, implement owner checks in the GroupController's by-ID methods to ensure that users can only access their own groups. Additionally, update the GroupServiceImpl to re-stamp the user ID during group modifications and deletions. For a more robust solution, consider centralizing the ownership validation for all by-ID group operations.