Live › vulnerability › CVE-2026-121556
FastBee, an IoT platform, has an insecure direct object reference in its ProductController, so an authenticated user can access products belonging to other tenants by supplying their product IDs. An attacker can enumerate sequential IDs to read MQTT account credentials and secrets, change product configuration, or delete products.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 16:21 UTC. All times on this page are UTC.
FastBee deployments with multiple tenants where users hold authenticated accounts. Single-tenant installations with no untrusted accounts are less exposed. The sources do not say which configurations are default.
No product ranges from the sources yet.
2.1.0.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
FastBee through 2.1.0 contains an insecure direct object reference vulnerability in ProductController that allows authenticated tenant users to access other tenants' products by supplying their product IDs. Attackers can enumerate sequential product IDs to read MQTT account, password, and secret values, overwrite product configuration including tenant_id, or delete products with cascading rows.
This page as .md · .json · in your agent: get_signal("CVE-2026-121556")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.