Insecure Direct Object Reference in FastBee DeviceController

CVE-2026-110124

What is CVE-2026-110124?

FastBee versions up to 2.1.0 contain an insecure direct object reference vulnerability found in the DeviceController. This flaw allows authenticated low-privilege users to manipulate device IDs sequentially, leading to unauthorized access to other tenants' devices. Attackers can enumerate device ID or serial number values, enabling them to read sensitive information such as the owner, IP address, and location of devices. Additionally, self-registered users can leverage this vulnerability to overwrite user_id and tenant_id, potentially taking control of devices across different tenants.

References