Insecure direct object reference in FastBee group endpoints
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- Low · Low · Low
- Fix status
- No fix listed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-639.
Summary
FastBee through 2.1.0 contains an insecure direct object reference that lets authenticated low-privilege users access other users' device groups. GroupController queries lack owner checks, a flaw classified as CWE-639. An attacker, including a self-registered user, can supply sequential group IDs to read, overwrite, reassign, rewrite device associations of, or delete other users' groups. CISA's SSVC rates exploitation as poc, and the references include no exploit link.
Written with Claude Haiku 5.5 from the sources below · 2026-10-28
Description from the CNA
FastBee through 2.1.0 contains an insecure direct object reference vulnerability that allows authenticated low-privilege users to access other users' device groups because GroupController queries lack owner checks. Attackers, including self-registered users, can supply sequential group IDs to read, overwrite, reassign, rewrite device associations of, or delete other users' groups.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
Remediation
The sources list no fixed version for FastBee.
Written with Claude Haiku 5.5 from the sources below · 2026-10-28
Timeline
- 2026-10-16 Threatist record created from CVE-2026-111654
- 2026-10-16 Alias added: GHSA-gm3x-2x46-fc3v
- 2026-10-21 CISA SSVC decision points changed
- 2026-10-21 Priority changed: LOW → MEDIUM
References
Other 3
- https://github.com/kerwincui/FastBee/blob/v2.1.0/springboot/fastbee-open-api/src/main/java/com/fastbee/data/controller/GroupController.java#L70-L137
- https://github.com/kerwincui/FastBee/blob/v2.1.0/springboot/fastbee-service/fastbee-iot-service/src/main/java/com/fastbee/iot/service/impl/GroupServiceImpl.java#L37-L143
- https://github.com/kerwincui/FastBee/blob/v2.1.0/springboot/fastbee-service/fastbee-iot-service/src/main/resources/mapper/iot/GroupMapper.xml#L36-L109
More kerwincui vulnerabilities
- TI-2026-72008 FastBee IDOR in device endpoints allows device takeover CVSS 4.0HIGH 8.6
- TI-2026-06758 kerwincui FastBee Tool Download Endpoint ToolController.java ToolController.download path traversal CVSS 4.0MEDIUM 5.3
- TI-2026-06759 kerwincui FastBee System Notice SysNoticeController.java add cross site scripting CVSS 4.0MEDIUM 5.1
Sources
- CVE-2026-111654 · CVE Program
- CVE-2026-111654 · NVD
- FIRST EPSS
- GHSA-gm3x-2x46-fc3v · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences