Vulnerabilities

TI-2026-84362 CVE-2026-121556 · GHSA-xvx6-5cj7-5p8g

Insecure direct object reference in FastBee exposes other tenants' products

MEDIUM 40

FastBee through 2.1.0 contains an insecure direct object reference vulnerability in ProductController that allows authenticated tenant users to access other tenants' products by supplying their product IDs.

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.00444 Published 2026-11-03 No fix listed CWE-639

TI-2026-83642 CVE-2026-120274 · GHSA-fcpv-5322-c269

Code injection in beecue FastBee Groovy Script Executor

LOW 23

A vulnerability was identified in beecue FastBee up to 2.1.0.

CVSS 4.0MEDIUM 5.1 Network High privileges No interaction EPSS 0.00248 Published 2026-11-01 No fix listed CWE-74

TI-2025-13928 CVE-2025-15251 · GHSA-5pmw-cmp3-g6wx

beecue FastBee SIP Message ReqAbstractHandler.java getRootElement xml external entity reference

MEDIUM 61

A vulnerability was detected in beecue FastBee up to 2.1.

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.00335 Published 2025-12-30 No fix listed CWE-610

Vulnerabilities

Filters

Insecure direct object reference in FastBee exposes other tenants' products

Code injection in beecue FastBee Groovy Script Executor

beecue FastBee SIP Message ReqAbstractHandler.java getRootElement xml external entity reference