CVE-2026-121556

Dashboard / Vulnerabilities / CVE-2026-121556

CVE-2026-121556

Published: 3 Nov 2026Last Modified: 5 Nov 2026

Summary: FastBee through 2.1.0 IDOR via /iot/product By-ID Endpoints

Details: FastBee through 2.1.0 contains an insecure direct object reference vulnerability in ProductController that allows authenticated tenant users to access other tenants' products by supplying their product IDs. Attackers can enumerate sequential product IDs to read MQTT account, password, and secret values, overwrite product configuration including tenant_id, or delete products with cascading rows.

References: https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/121xxx/CVE-2026-121556.json, https://nvd.nist.gov/vuln/detail/CVE-2026-121556, https://www.vulncheck.com/advisories/fastbee-through-2.1.0-idor-via-iot-product-by-id-endpoints, https://github.com/beecue/FastBee/issues/32, https://github.com/beecue/FastBee/commit/3393e3223965a9dc9682dfb2bd37635fffa0fbd2, https://github.com/kerwincui/FastBee, https://github.com/kerwincui/FastBee/blob/v2.1.0/springboot/fastbee-open-api/src/main/java/com/fastbee/data/controller/ProductController.java#L77-L141, https://github.com/kerwincui/FastBee/blob/v2.1.0/springboot/fastbee-service/fastbee-iot-service/src/main/java/com/fastbee/iot/service/impl/ProductServiceImpl.java#L72-L92, https://github.com/kerwincui/FastBee/blob/v2.1.0/springboot/fastbee-service/fastbee-iot-service/src/main/resources/mapper/iot/ProductMapper.xml#L37-L67

Affected packages

Package

Name:

Purl:

Affected ranges

Type: GIT

Events:

Introduced- 0

Fixed -3393e3223965a9dc9682dfb2bd37635fffa0fbd2

Affected versions

v2.1.0

Common Vulnerability Scoring System

Attack Vector

Network

Adjacent

Local

Physical

Privileges Required

None

Low

High

User Interaction

None

Required

Scope

Unchanged

Changed

Confidentiality

None

Low

High

Integrity

None

Low

High

Availability

None

Low

High