Unsecured Direct Access to Images in Meari IoT Cloud on Alibaba OSS
CVE-2026-33359

7.5HIGH

Key Information:

Vendor

Meari

Status
Alibaba Oss Hosted
Vendor
CVE Published:
11 May 2026

What is CVE-2026-33359?

A vulnerability in Meari IoT Cloud hosted on Alibaba OSS allows attackers to access motion snapshots without any authentication or authorization. The images can be retrieved through URLs that act as direct object references and do not enforce expiry. This lack of security controls means that sensitive images remain accessible beyond intended usage windows, potentially leading to privacy breaches.

Affected Version(s)

Alibaba OSS Hosted April, 2026

References

https://github.com/xn0tsa/nobody-puts-baby-in-a-corner
technical-description
https://www.runzero.com/advisories/meari-unauthenticated-...
third-party-advisory

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Sammy Azdoufal
Tod Beardsley of runZero, Inc.
.