CVE-2026-33359CWE-862

Meari unauthenticated alert image access in cloud object storage

High · published May 11, 2026

CVSS v3.1
7.5
EPSS
1%
Percentile
42.2
In the wild
Unconfirmed
What it is

In Meari IoT Cloud alert image storage on Alibaba OSS (latest observed; storage service version not disclosed), motion snapshots are retrievable without authentication, signed URLs, or expiry enforcement. URLs function as direct object references and remain valid beyond expected operational windows.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00504 · 42.2th percentile
Weakness
CWE-862 · Missing Authorization
Published
2026-05-11T16:03Z
EPSS history
Timeline
  • 11 MAY 16:03Z
    Meari unauthenticated alert image access in cloud object storage
    cvelistv5