CVE-2026-121556
FastBee through 2.1.0 IDOR via /iot/product By-ID Endpoints
CVSS Score
8.3
EPSS Score
0.0%
EPSS Percentile
0th
FastBee through 2.1.0 contains an insecure direct object reference vulnerability in ProductController that allows authenticated tenant users to access other tenants' products by supplying their product IDs. Attackers can enumerate sequential product IDs to read MQTT account, password, and secret values, overwrite product configuration including tenant_id, or delete products with cascading rows.
| CWE | CWE-639 |
| Vendor | beecue |
| Product | fastbee |
| Published | Nov 3, 2026 |
| Last Updated | Nov 3, 2026 |
Stay Ahead of the Next One
Get instant alerts for beecue fastbee
Be the first to know when new high vulnerabilities affecting beecue fastbee are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
Low
Affected Versions
beecue / FastBee
0 ≤ 2.1.0
References
github.com: https://github.com/beecue/FastBee/issues/32 github.com: https://github.com/kerwincui/FastBee github.com: https://github.com/beecue/FastBee/commit/3393e3223965a9dc9682dfb2bd37635fffa0fbd2 github.com: https://github.com/kerwincui/FastBee/blob/v2.1.0/springboot/fastbee-open-api/src/main/java/com/fastbee/data/controller/ProductController.java#L77-L141 github.com: https://github.com/kerwincui/FastBee/blob/v2.1.0/springboot/fastbee-service/fastbee-iot-service/src/main/java/com/fastbee/iot/service/impl/ProductServiceImpl.java#L72-L92 github.com: https://github.com/kerwincui/FastBee/blob/v2.1.0/springboot/fastbee-service/fastbee-iot-service/src/main/resources/mapper/iot/ProductMapper.xml#L37-L67 vulncheck.com: https://www.vulncheck.com/advisories/fastbee-through-2.1.0-idor-via-iot-product-by-id-endpoints
Credits
hieuPenguinnn