{"id":"CVE-2026-105821","kind":"vulnerability","aliases":["CVE-2026-105821"],"related":[],"title":"Tapo Cloud: broken access control lets one device write to another's storage","description":"The Tapo\nCloud MQTT broker contains a broken access control vulnerability in a proxy\ntopic used by authenticated Tapo devices to request service tokens. The broker\ndoes not verify that the device ID supplied in a proxy request belongs to the\nauthenticated device. An attacker who owns a Tapo device and knows another\ndevice's ID may obtain a device token scoped to the target device and use it to\nupload attacker-controlled content to the target user's Tapo Cloud storage. The\ncontent may then be presented in the Tapo app as a legitimate event.\n\n\n\n\n\nSuccessful\nexploitation may allow an attacker to upload attacker-controlled content that\nis presented to a target user as a legitimate Tapo event, retrieve internal\nservice information through crafted proxy requests, or abuse Tapo Cloud\noutbound request capability in activity that could affect service\navailability.","summary":"The Tapo Cloud MQTT broker does not check that a device ID in a proxy request belongs to the logged-in device. An attacker with their own Tapo device and another device's ID can get a token for that device and upload content that appears in the victim's Tapo app as a real event.","severity":"high","cvss":8.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["iot","smart-home","tapo","tapo-cloud","vendor"],"not_affected_if":["no-tapo-devices"],"how_to_check":"Cloud-side flaw, so there is no local version to check. If you use Tapo cameras or devices, look in the Tapo app event list for clips or events you did not expect. TP-Link has not published affected models.","fix":null,"status":"open","published_at":"2026-11-03T20:18:05+00:00","first_seen_at":"2026-11-03T20:49:22+00:00","triaged_at":"2026-11-03T20:49:51+00:00","updated_at":"2026-11-03T21:03:40+00:00","category":"vendor","confidence":0.5,"triage":{"at":"2026-11-03T20:49:51Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Tapo Cloud: broken access control lets one device write to another's storage","impact":"medium","summary":"The Tapo Cloud MQTT broker does not check that a device ID in a proxy request belongs to the logged-in device. An attacker with their own Tapo device and another device's ID can get a token for that device and upload content that appears in the victim's Tapo app as a real event.","audience":"everyone","category":"vendor","nicknames":[],"who_cares":["tapo","tapo-cloud","iot","smart-home"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"forged events appear in victim's app and internal service info leaks","analyst_note":"Check the NVD entry and TP-Link's advisory for affected models, firmware and the fixed version, since the sources state none.","how_to_check":"unknown","plain_action":"Check the Tapo app for unexpected events, and wait for TP-Link to confirm a fix for its Tapo Cloud service.","needs_analyst":true,"not_affected_if":["no-tapo-devices"],"who_is_affected":"Tapo camera and smart home device owners whose devices use Tapo Cloud are the people exposed, and the flaw sits in the vendor's cloud broker rather than in the customer's own equipment. The sources do not name the affected models or firmware, so the exposed set is unknown. Only attackers who own a Tapo device and know a target device's ID can use it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000705,"input_tokens":4305,"output_tokens":548,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check the NVD entry and TP-Link's advisory for affected models, firmware and the fixed version, since the sources state none.","search":"'-105821':16A,19A '-2026':15A,18A 'abus':216C 'access':4A,94C 'activ':223C 'affect':226C 'allow':186C 'anoth':11A,60B,138C 'app':81B,178C 'appear':75B 'attack':53B,130C,158C,188C,192C 'attacker-control':157C,191C 'authent':103C,127C 'avail':228C 'belong':45B,124C 'broken':3A,93C 'broker':33B,90C,111C 'capabl':221C 'check':36B 'cloud':2A,27B,31B,88C,167C,218C 'contain':91C 'content':73B,160C,170C,194C 'control':5A,95C,159C,193C 'could':225C 'craft':212C 'cve':14A,17A 'devic':8A,39B,51B,58B,61B,70B,105C,117C,128C,135C,139C,145C,151C 'event':85B,182C,206C 'exploit':184C 'get':65B 'home':23B 'id':40B,63B,118C,141C 'inform':210C 'intern':208C 'iot':20B 'know':137C 'legitim':181C,204C 'let':6A 'log':49B 'logged-in':48B 'may':142C,171C,185C 'mqtt':32B,89C 'obtain':143C 'one':7A 'outbound':219C 'own':132C 'present':174C,197C 'proxi':43B,99C,122C,213C 'real':84B 'request':44B,107C,123C,214C,220C 'retriev':207C 'scope':147C 'servic':108C,209C,227C 'smart':22B 'smart-hom':21B 'storag':13A,168C 'success':183C 'suppli':119C 'tapo':1A,24B,26B,30B,57B,80B,87C,104C,134C,166C,177C,205C,217C 'tapo-cloud':25B 'target':150C,163C,200C 'token':67B,109C,146C 'topic':100C 'upload':72B,156C,190C 'use':101C,153C 'user':164C,201C 'vendor':28B 'verifi':114C 'victim':78B 'vulner':96C 'write':9A","nicknames":[],"mitigations":[],"who_affected":"Tapo Cloud users could have fake events appear in their Tapo app. The flaw is in TP-Link's cloud MQTT broker, not in the device. An attacker needs their own Tapo device and the victim device's ID. TP-Link has not named affected models or firmware. People with no Tapo devices can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"everyone","plain_action":"Check the Tapo app for unexpected events, and wait for TP-Link to confirm a fix for its Tapo Cloud service.","pkeys":[],"ptokens":[],"labels":["high","iot","smarthome","tapo","tapocloud","vendor"],"campaign_type":null,"first_public_at":"2026-11-03T20:18:05+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"f23511db-6c3e-4e32-a477-6aa17d310630","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-105821","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105821","severity":null,"published_at":"2026-11-03T20:18:05+00:00","modified_at":"2026-11-03T20:18:05+00:00","first_seen_at":"2026-11-03T20:49:22+00:00","fetched_at":"2026-11-03T20:49:22+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-105821:1563","url":null,"severity":null,"published_at":"2026-11-03T21:03:40+00:00","modified_at":"2026-11-03T21:03:40+00:00","first_seen_at":"2026-11-03T21:03:40+00:00","fetched_at":"2026-11-03T21:03:40+00:00","note":"No TP-Link advisory found (TP-Link advisory index empty, only the unrelated C210 advisory). Only NVD and Rapid7 text, which state no affected models, fix or fix status. Nothing verified. Fix is unknown; the earlier fix_status none has no vendor page behind it. Sibling CVE-2026-105822 is the SSRF in the same proxy. Recheck for a TP-Link FAQ page."}],"documents":[{"id":60685,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105821","title":"NVD CVE-2026-105821","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":60686,"url":"https://www.rapid7.com/db/vulnerabilities/cve-2026-105821/","title":"Rapid7 CVE-2026-105821","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}