CVE-2026-121556highCWE-639

CVE-2026-121556: high-severity vulnerability in beecue FastBee

FastBee through 2.1.0 IDOR via /iot/product By-ID Endpoints

Published

Follow this CVE+ Monitor FastBee

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 8.7epss 0.4%
FastBee through 2.1.0 contains an insecure direct object reference vulnerability in ProductController that allows authenticated tenant users to access other tenants' products by supplying their product IDs. Attackers can enumerate sequential product IDs to read MQTT account, password, and secret values, overwrite product configuration including tenant_id, or delete products with cascading rows.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N
Affected products
beecue · FastBee
Related CVEs — beecue FastBee

In the same product, most dangerous first.

CVE-2025-15251MEDIUMbeecue FastBee SIP Message ReqAbstractHandler.java getRootElement xml external entity referenceEPSS 0.3%CVE-2026-120274MEDIUMbeecue FastBee Groovy Script Executor script code injectionEPSS 0.2%