CVE-2026-33356CWE-639

Meari MQTT broker missing per-device subscribe ACL

High · published May 11, 2026

CVSS v3.1
7.7
EPSS
0%
Percentile
27.8
In the wild
Unconfirmed
What it is

In Meari IoT Cloud MQTT Broker deployments running EMQX 4.x, any authenticated low-privilege account can subscribe to global wildcard topics and receive telemetry from devices the user does not own. The broker enforces publish restrictions but does not enforce equivalent subscribe authorization at per-device scope.

The record
Technical detail
CVSS v3.1
7.7 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00354 · 27.8th percentile
Weakness
CWE-639 · Authorization Bypass Through User-Controlled Key
Published
2026-05-11T16:02Z
EPSS history
Timeline
  • 11 MAY 16:02Z
    Meari MQTT broker missing per-device subscribe ACL
    cvelistv5