CVE-2026-101104CWE-862broken-access-control

CVE-2026-101104

High · published October 2, 2026

CVSS v3.1
7.7
EPSS
0%
Percentile
17.9
In the wild
Unconfirmed
What it is

The Meari IoT Cloud Platform OpenAPI Service is vulnerable to an authorization flaw that allows authenticated users to manipulate the configurations of devices they do not own. This vulnerability enables attackers to perform unauthorized actions, such as altering device settings or triggering unintended behaviors, without verifying ownership or permissions.

The record
Technical detail
CVSS v3.1
7.7 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N
CVSS v4.0
6.3 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N
EPSS
0.00268 · 17.9th percentile
Weakness
CWE-862 · Missing Authorization
Published
2026-10-02T20:16Z
References (3)
https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-274-06.json · [email protected]https://www.cisa.gov/news-events/ics-advisories/icsa-26-274-06 · [email protected]https://www.meari.com/en/downLoadCenter · [email protected]
EPSS history
Timeline
  • 04 OCT 03:27Z
    EPSS moved — → 0%
    epss
  • 02 OCT 15:58Z
    Missing Authorization in Meari IoT Cloud Platform OpenAPI Service
    cvelistv5