FastBee CVE-2026-111654

Requires a valid authenticated FastBee account at low privilege; because the product supports self-registration, any unauthenticated party can obtain such an account, so the authentication barrier is minimal in practice. The attacker needs network access to the GroupController REST endpoints (controller lines 70-137) on a FastBee instance at version 2.1.0 or earlier, and exploits the fact that GroupServiceImpl/GroupMapper queries omit an owner/tenant check, allowing supplied sequential group IDs to resolve to arbitrary users' groups. Limiting factors: exploitation is confined to device-group objects (read, overwrite, reassign device associations, or delete) and does not yield code execution or full account takeover; it also requires that the deployment not have added a compensating ownership/ACL control.

This is a genuine but moderate-priority authorization flaw, not a critical remote-code issue. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) with base score 5.3 tells a consistent story: the vulnerable GroupController endpoints are reachable over the network with low attack complexity, require only low-privilege authentication, and need no user interaction - and because FastBee permits self-registration, that PR:L barrier is effectively trivial to clear. The impact metrics are all 'Low' (VC:L/VI:L/VA:L) and scope-subsequent impacts are None, correctly reflecting that damage is confined to other users' device-group objects rather than full system compromise. No EPSS score, CISA KEV entry, or SSVC decision data was supplied in the input, so exploitation-probability and automatability signals cannot be weighed here; the absence of a KEV listing and of any POC=YES flag means there is no confirmed active exploitation. Note a mild signal tension: the input includes no EPSS value at all, so I cannot compare predicted exploitation likelihood against the KEV/POC signals - treat exploitation likelihood as unquantified. The one caveat defenders should verify: the public hackmd write-up and VulnCheck advisory describe the vulnerable code paths in detail, which lowers the practical bar to developing an exploit even though no packaged exploit code is flagged in this data.

An attacker self-registers a low-privilege FastBee account, authenticates to the API, and then iterates sequential numeric group IDs against GroupController endpoints that perform no owner check, reading and tampering with device groups belonging to other tenants. No packaged proof-of-concept is flagged in the input, but the VulnCheck advisory and a public hackmd write-up detail the exact vulnerable controller, service, and mapper code paths, making exploitation straightforward to reproduce.