CVE-2026-101104

HIGH 7.7

Missing Authorization in Meari IoT Cloud Platform OpenAPI Service

CVSS Score

7.7

EPSS Score

0.0%

EPSS Percentile

0th

The Meari IoT Cloud Platform OpenAPI Service is vulnerable to an authorization flaw that allows authenticated users to manipulate the configurations of devices they do not own. This vulnerability enables attackers to perform unauthorized actions, such as altering device settings or triggering unintended behaviors, without verifying ownership or permissions.

CWE	CWE-862
Vendor	meari
Product	iot cloud platform openapi service
Published	Oct 2, 2026

Stay Ahead of the Next One

Get instant alerts for meari iot cloud platform openapi service

Be the first to know when new high vulnerabilities affecting meari iot cloud platform openapi service are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

None

Integrity

High

Availability

None

Affected Versions

Meari / IoT Cloud Platform OpenAPI Service

All verisons

References

NVD ↗ CVE.org ↗ EPSS Data ↗

meari.com: https://www.meari.com/en/downLoadCenter cisa.gov: https://www.cisa.gov/news-events/ics-advisories/icsa-26-274-06 github.com: https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-274-06.json

Credits

🔍 Gabriel Adams reported this vulnerability to CISA.