CVE-2026-121556
Deferred Deferred - Pending Action

Insecure Direct Object Reference in FastBee ProductController

Publication date: 2026-11-03

Last updated on: 2026-11-03

Assigner: VulnCheck

Description
FastBee through 2.1.0 contains an insecure direct object reference vulnerability in ProductController that allows authenticated tenant users to access other tenants' products by supplying their product IDs. Attackers can enumerate sequential product IDs to read MQTT account, password, and secret values, overwrite product configuration including tenant_id, or delete products with cascading rows.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-03
Last Modified
2026-11-03
Generated
2026-11-03
AI Q&A
2026-11-03
EPSS Evaluated
N/A
NVD
CVE-2026-121556
EUVD
EUVD-2026-115901

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
beecue FastBee 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

FastBee through 2.1.0 has an insecure direct object reference vulnerability in ProductController. Authenticated tenant users can access other tenants' products by providing their product IDs. Attackers can guess sequential product IDs to read sensitive MQTT credentials, modify product configurations including tenant IDs, or delete products which may cause cascading data loss.

Impact Analysis

If exploited, attackers could steal MQTT account credentials, passwords, and secrets. They could also alter product settings to gain unauthorized access or delete products, potentially disrupting operations and causing data loss across multiple tenants.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating confidentiality requirements in GDPR and HIPAA. Exposure of MQTT credentials and product data may result in non-compliance with data protection regulations, leading to legal penalties and reputational damage.

Mitigation Strategies

Immediately update FastBee to version 2.1.0 or later to patch the insecure direct object reference vulnerability. Review and restrict tenant user permissions to prevent unauthorized access to other tenants' products. Monitor MQTT account credentials and product configurations for unauthorized changes.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-121556. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...