CVE-2026-116017 Xiaozhi-esp32-server before 0.9.8 IDOR via device address-book endpoint

Xiaozhi-esp32-server before 0.9.8 contains an insecure direct object reference vulnerability in the manager-api DeviceController.getAddressBook handler that allows authenticated users to read other users' device address books. Attackers with a normal or self-registered account can request...

CVE-2026-116017

The Xiaozhi-esp32-server software (versions before 0.9.8 ) is vulnerable to an Insecure Direct Object Reference (IDOR) flaw in the manager-api DeviceController.getAddressBook handler. This vulnerability allows authenticated users, including those with normal or self-registered accounts, to access...

CVE-2026-116017 Xiaozhi-esp32-server before 0.9.8 IDOR via device address-book endpoint

Xiaozhi-esp32-server before 0.9.8 contains an insecure direct object reference vulnerability in the manager-api DeviceController.getAddressBook handler that allows authenticated users to read other users' device address books. Attackers with a normal or self-registered account can request...

CVE-2026-116017 Xiaozhi-esp32-server before 0.9.8 IDOR via device address-book endpoint

Xiaozhi-esp32-server before 0.9.8 contains an insecure direct object reference vulnerability in the manager-api DeviceController.getAddressBook handler that allows authenticated users to read other users' device address books. Attackers with a normal or self-registered account can request...

CVE-2026-110124

FastBee through 2.1.0 contains an insecure direct object reference vulnerability in DeviceController that allows authenticated low-privilege users to read and modify other tenants' devices by supplying sequential device IDs. Self-registered attackers can enumerate deviceId or serialNumber values ...

CVE-2026-110124 FastBee through 2.1.0 IDOR via DeviceController /iot/device Endpoints

FastBee through 2.1.0 contains an insecure direct object reference vulnerability in DeviceController that allows authenticated low-privilege users to read and modify other tenants' devices by supplying sequential device IDs. Self-registered attackers can enumerate deviceId or serialNumber values ...

CVE-2026-110124

The FastBee IoT platform, versions through 2.1.0 , is susceptible to an Insecure Direct Object Reference (IDOR) vulnerability within the DeviceController . This flaw allows authenticated low-privilege users to access and manipulate data belonging to other tenants by providing sequential device ID...

EUVD-2026-98889

FastBee through 2.1.0 contains an insecure direct object reference vulnerability in DeviceController that allows authenticated low-privilege users to read and modify other tenants' devices by supplying sequential device IDs. Self-registered attackers can enumerate deviceId or serialNumber values ...

CVE-2026-110124

FastBee through 2.1.0 contains an insecure direct object reference vulnerability in DeviceController that allows authenticated low-privilege users to read and modify other tenants' devices by supplying sequential device IDs. Self-registered attackers can enumerate deviceId or serialNumber values ...

CVE-2026-110124 FastBee through 2.1.0 IDOR via DeviceController /iot/device Endpoints

FastBee through 2.1.0 contains an insecure direct object reference vulnerability in DeviceController that allows authenticated low-privilege users to read and modify other tenants' devices by supplying sequential device IDs. Self-registered attackers can enumerate deviceId or serialNumber values ...

CVE-2026-110124 FastBee through 2.1.0 IDOR via DeviceController /iot/device Endpoints

FastBee through 2.1.0 contains an insecure direct object reference vulnerability in DeviceController that allows authenticated low-privilege users to read and modify other tenants' devices by supplying sequential device IDs. Self-registered attackers can enumerate deviceId or serialNumber values ...

PT-2026-111716

FastBee through 2.1.0 contains an insecure direct object reference vulnerability in DeviceController that allows authenticated low-privilege users to read and modify other tenants' devices by supplying sequential device IDs. Self-registered attackers can enumerate deviceId or serialNumber values ...

CVE-2026-110124: Authorization Bypass Through User-Controlled Key

FastBee through 2.1.0 contains an insecure direct object reference vulnerability in DeviceController that allows authenticated low-privilege users to read and modify other tenants' devices by supplying sequential device IDs. Self-registered attackers can enumerate deviceId or serialNumber values ...

Kerwin FastBee authorization issue vulnerability

Kerwin FastBee versions 2.1.0 and earlier have an authorization issue vulnerability. This vulnerability stems from insecure direct object references in the DeviceController. Certified low-privilege users can read and modify devices of other tenants by providing the sequential device ID...