---
id: "CVE-2026-105821"
kind: "vulnerability"
aliases: ["CVE-2026-105821"]
title: "Tapo Cloud: broken access control lets one device write to another's storage"
severity: "high"
cvss: 8.3
epss: null
exploited: false
status: "open"
category: "vendor"
products: []
ecosystems: []
tags: ["iot", "smart-home", "tapo", "tapo-cloud", "vendor"]
not_affected_if: ["no-tapo-devices"]
published_at: "2026-11-03T20:18:05+00:00"
first_seen_at: "2026-11-03T20:49:22+00:00"
updated_at: "2026-11-03T21:03:40+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-105821", "first_seen_at": "2026-11-03T20:49:22+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-11-03T21:03:40+00:00"}]
---

# Tapo Cloud: broken access control lets one device write to another's storage

The Tapo Cloud MQTT broker does not check that a device ID in a proxy request belongs to the logged-in device. An attacker with their own Tapo device and another device's ID can get a token for that device and upload content that appears in the victim's Tapo app as a real event.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

Cloud-side flaw, so there is no local version to check. If you use Tapo cameras or devices, look in the Tapo app event list for clips or events you did not expect. TP-Link has not published affected models.

## Timeline

- 2026-11-03T20:49:22+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-105821
- 2026-11-03T21:03:40+00:00 analyst — No TP-Link advisory found (TP-Link advisory index empty, only the unrelated C210 advisory). Only NVD and Rapid7 text, which state no affected models, fix or fix status. Nothing verified. Fix is unknown; the earlier fix_status none has no vendor page behind it. Sibling CVE-2026-105822 is the SSRF in the same proxy. Recheck for a TP-Link FAQ page.

## Documents

- [describes] NVD CVE-2026-105821 https://nvd.nist.gov/vuln/detail/CVE-2026-105821
- [mentions] Rapid7 CVE-2026-105821 https://www.rapid7.com/db/vulnerabilities/cve-2026-105821/

## From the sources

The Tapo
Cloud MQTT broker contains a broken access control vulnerability in a proxy
topic used by authenticated Tapo devices to request service tokens. The broker
does not verify that the device ID supplied in a proxy request belongs to the
authenticated device. An attacker who owns a Tapo device and knows another
device's ID may obtain a device token scoped to the target device and use it to
upload attacker-controlled content to the target user's Tapo Cloud storage. The
content may then be presented in the Tapo app as a legitimate event.





Successful
exploitation may allow an attacker to upload attacker-controlled content that
is presented to a target user as a legitimate Tapo event, retrieve internal
service information through crafted proxy requests, or abuse Tapo Cloud
outbound request capability in activity that could affect service
availability.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_