FastBee IDOR lets tenants access other tenants' products

Summary

In FastBee's product management, an authenticated tenant user can access another tenant's products by supplying their product IDs. Attackers can enumerate sequential IDs to read MQTT account, password, and secret values, overwrite product settings, or delete products. Versions through 2.1.0 are affected.

Affected when

• Authenticated tenant account

What to do

Check that you run a version newer than 2.1.0, and read the vendor's advisory. No fixed version is named in the sources.

Products and platforms

• FastBee

CVE IDs

• CVE-2026-121556 (opens in a new tab)

Sources

• Write-up: github.com (opens in a new tab) · github.com (opens in a new tab) · github.com (opens in a new tab) · vulncheck.com (opens in a new tab)
• CVE record: cve.org (opens in a new tab)

Times

First published 2026-11-03 15:17 UTC

First seen 2026-11-09 14:50 UTC