Live › vulnerability › CVE-2026-111654
Go to dashboardFastBee through 2.1.0 has a missing ownership check in GroupController, so any logged-in user can supply another user's sequential group ID. An attacker can then read, overwrite, reassign, or delete that user's device groups.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams that run FastBee 2.1.0 or earlier with self-registration or multiple user accounts sharing one instance are exposed, because any authenticated user can reach other users' groups by ID. Single-user deployments with no other accounts have little to lose from this flaw.
No product ranges from the sources yet.
2.1.0 are affected.Unknown from the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
FastBee through 2.1.0 contains an insecure direct object reference vulnerability that allows authenticated low-privilege users to access other users' device groups because GroupController queries lack owner checks. Attackers, including self-registered users, can supply sequential group IDs to read, overwrite, reassign, rewrite device associations of, or delete other users' groups.
This page as .md · .json · in your agent: get_signal("CVE-2026-111654")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.