CVE-2026-110124: FastBee through 2.1.0 IDOR via DeviceController /iot/device Endpoints
FastBee through 2.1.0 contains an insecure direct object reference vulnerability in DeviceController that allows authenticated low-privilege users to read and modify other tenants' devices by supplying sequential device IDs. Self-registered attackers can enumerate deviceId or serialNumber values to read owner, IP, and location data, and overwrite userid and tenantid to take over devices.
Affected Software
Event History
Frequently Asked Questions
What level of access does an attacker need?
The attacker needs an authenticated low-privilege account. The issue can be exploited by self-registered users.
Which organizations or tenants are exposed to another tenant's user?
Any tenant whose device identifiers can be supplied to the affected endpoints may be exposed to authenticated users from other tenants. Sequential device IDs and device serial numbers can be enumerated to target devices.
What information and control can an attacker obtain?
An attacker can read device owner, IP address, and location data. They can also modify device ownership fields, including user_id and tenant_id, to take over another tenant's device.
Which releases are identified as affected?
FastBee through version 2.1.0 is identified as affected.