CVE-2026-101104

High7.7 Published on Oct 2, 2026

The Meari IoT Cloud Platform OpenAPI Service is vulnerable to an authorization flaw that allows authenticated users to manipulate the configurations of devices they do not own. This vulnerability enables attackers to perform unauthorized actions, such as altering device settings or triggering unintended behaviors, without verifying ownership or permissions.

CVSS score7.7 / 10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N

Weakness type (CWE)CWE-862

Vulnerabilities

Meari OpenAPI Authorization Gaps Expose Device Controls and Sensitive Data

CISA disclosed two Meari OpenAPI authorization flaws enabling authenticated users to alter device configs and access shadows, with no fix planned.

Oct 2, 202609:24 5 min readRead

This product uses the NVD API but is not endorsed or certified by the NVD.

CVE database

Related articles

Meari OpenAPI Authorization Gaps Expose Device Controls and Sensitive Data