CVE-2026-96613

MEDIUM 6.5

Missing Authorization in Meari IoT Cloud Platform OpenAPI Service

CVSS Score

6.5

EPSS Score

0.0%

EPSS Percentile

0th

The Meari IoT Cloud Platform OpenAPI Service is vulnerable to an authorization flaw that allows authenticated users to access the complete device shadow of any device by specifying its device ID. This vulnerability exposes sensitive information, such as device credentials, owner details, network data, and telemetry, without verifying any relationship between the requester and the target device.

CWE	CWE-862
Vendor	meari
Product	iot cloud platform openapi service
Published	Oct 2, 2026

Stay Ahead of the Next One

Get instant alerts for meari iot cloud platform openapi service

Be the first to know when new medium vulnerabilities affecting meari iot cloud platform openapi service are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Affected Versions

Meari / IoT Cloud Platform OpenAPI Service

All verisons

References

NVD ↗ CVE.org ↗ EPSS Data ↗

meari.com: https://www.meari.com/en/downLoadCenter cisa.gov: https://www.cisa.gov/news-events/ics-advisories/icsa-26-274-06 github.com: https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-274-06.json

Credits

🔍 Gabriel Adams reported this vulnerability to CISA.