Missing Authorization in Meari IoT Cloud Platform OpenAPI Service
The Meari IoT Cloud Platform OpenAPI Service is vulnerable to an authorization flaw that allows authenticated users to access the complete device shadow of any device by specifying its device ID. This vulnerability exposes sensitive information, such as device credentials, owner details, network data, and telemetry, without verifying any relationship between the requester and the target device.
CVE-2026-96613
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-96613
IoT Cloud Platform OpenAPI Service
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"vendor": "Meari",
"product": "IoT Cloud Platform OpenAPI Service",
"versions": [
{
"status": "affected",
"version": "All verisons",
"versionType": "custom"
}
],
"defaultStatus": "unaffected"
}
]- Related CVEs
- CVE-2026-96613
Source reference:
/cveMetadata/cveId
Publisher severity
high
Source reference: /containers/cna/metrics
- Event
- #8493 · Revision 1
- Added to Heist Feed
- Publisher date