CVE-2026-101104: Missing Authorization in Meari IoT Cloud Platform OpenAPI Service
The Meari IoT Cloud Platform OpenAPI Service is vulnerable to an authorization flaw that allows authenticated users to manipulate the configurations of devices they do not own. This vulnerability enables attackers to perform unauthorized actions, such as altering device settings or triggering unintended behaviors, without verifying ownership or permissions.
Affected Software
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
The attacker needs an authenticated account with low privileges. Exploitation does not require user interaction and can be performed over the network.
Which deployments and users are at risk?
Users of the Meari IoT Cloud Platform OpenAPI Service are at risk where authenticated users can access device-configuration functions. The flaw permits a user to target devices they do not own because ownership or permission checks are not enforced.
What is the expected impact of successful exploitation?
Successful exploitation affects device configuration integrity: an attacker can alter settings or trigger unintended device behavior. The supplied vector indicates no direct confidentiality or availability impact, but the impact scope extends beyond the attacker's own authorization boundary.