CVE-2026-111654: FastBee through 2.1.0 IDOR via /iot/group By-ID Endpoints
FastBee through 2.1.0 contains an insecure direct object reference vulnerability that allows authenticated low-privilege users to access other users' device groups because GroupController queries lack owner checks. Attackers, including self-registered users, can supply sequential group IDs to read, overwrite, reassign, rewrite device associations of, or delete other users' groups.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated low-privilege FastBee user can exploit it, including a user who self-registers. No user interaction is required.
What access can an attacker gain through the affected endpoints?
An attacker can use sequential group IDs to access other users' device groups. They may read, overwrite, reassign, delete groups, or rewrite the groups' device associations.
Are default deployments affected?
The issue is caused by missing owner checks in GroupController queries. Deployments that expose the affected /iot/group by-ID functionality to authenticated low-privilege users are affected; the provided data does not identify any configuration prerequisite beyond authenticated access.
How can defenders check for exposure or abuse?
Review access and audit logs for /iot/group requests where a user accesses or modifies group IDs belonging to another user, especially sequential ID enumeration. Verify that every by-ID group read and modification operation enforces ownership checks before returning or changing the group.