Critical Authorization Flaws Discovered in Meari IoT Cloud Platform OpenAPI Service

The Cybersecurity and Infrastructure Security Agency (CISA) published advisory ICSA-26-274-06 on October 1, 2026, detailing two critical authorization vulnerabilities in the Meari IoT Cloud Platform OpenAPI Service. The affected product, deployed worldwide with vendor headquarters in China, is susceptible to flaws that could allow authenticated attackers to overstep their privileges.

CVE-2026-101104 involves a Missing Authorization flaw. Exploitation could allow authenticated users to manipulate the configurations of devices they do not own, potentially altering device settings or triggering unintended behaviors without verifying ownership or permissions. The CVSS v3.1 base score is 7.7 (HIGH), with the vector string AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N.

CVE-2026-96613 is another authorization flaw that allows authenticated users to access the complete device shadow of any device by specifying its device ID. This exposure includes sensitive information such as device credentials, owner details, network data, and telemetry. The CVSS v3.1 base score for this vulnerability is 6.5 (MEDIUM), with the vector string AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. A CVSS v4.0 score of 7.1 (HIGH) is also assigned, reflecting a vector of AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N.

The researcher Gabriel Adams reported these vulnerabilities to CISA. Both flaws are categorized under CWE-862 (Missing Authorization).

A significant concern is the vendor's response: Meari has stated that no fix is planned and did not respond to CISA's coordination attempts. The advisory notes that IoT Cloud Platform OpenAPI users are advised to contact Meari for support via the company's download center. Due to the absence of a patch, CISA recommends that organizations minimize network exposure, ensure control system devices are not accessible from the internet, and locate devices behind firewalls isolated from business networks. When remote access is required, the use of Virtual Private Networks (VPNs) is advised, though VPNs should be kept up to date.