FastBee EUVD-2026-98889

Requires a valid low-privilege FastBee tenant account, which an attacker can obtain themselves where self-registration is enabled (the description explicitly cites 'self-registered attackers'); the instance must be reachable and running FastBee 2.1.0 or earlier. Exploitation then depends only on supplying sequential device identifiers to the DeviceController device endpoints - no special feature toggle, no victim interaction, and no elevated role are needed. The practical LIMITING factors are: an account is required (so PR:L, not fully unauthenticated), the deployment must be multi-tenant for cross-tenant impact to matter, and open self-registration being disabled would raise the bar to needing any pre-existing user credential.

This is a genuine, prioritizable authorization flaw, though not a drop-everything emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N, 8.6 HIGH) is internally consistent with the description: network-reachable, low attack complexity, low privileges (a self-registered tenant account), no user interaction, with high confidentiality and integrity impact and no availability impact - matching CWE-639 (IDOR / authorization bypass via user-controlled key). The low PR:L is realistic because any self-registered user can obtain the needed account, which effectively lowers the barrier close to unauthenticated in deployments that allow open registration. No EPSS score, CISA KEV entry, or SSVC decision data was provided in the input, so exploitation-probability and automatability signals are UNKNOWN and cannot be used here; absence of these is not evidence of low risk. No exploit code is referenced, but a detailed public technical write-up exists (hackmd.io) plus a VulnCheck advisory, which substantially lowers the effort for an attacker to reproduce the issue. The flaw is sequential-ID enumeration against a documented endpoint - trivially automatable in practice even though no SSVC 'automatable' flag is supplied. Net: a real priority for anyone running FastBee in a multi-tenant mode, tempered mainly by the product's limited deployment footprint rather than by any technical difficulty.

An attacker self-registers a normal low-privilege tenant account on an internet-facing FastBee instance, then issues authenticated requests to the DeviceController device endpoints while incrementing deviceId or serialNumber values to read other tenants' device owner, IP, and location data. Using the same endpoints they overwrite the user_id and tenant_id fields on a victim's device to reassign ownership to themselves, taking control of the device. No public exploit code is identified, but a step-by-step technical write-up and a vendor-style VulnCheck advisory are publicly available, making reproduction straightforward.