---
id: CVE-2026-105821
title: >-
  Broken Access Control Leading to Cross-Device Token Issuance in Tapo Cloud
  MQTT Proxy
summary: |-
  The Tapo
  Cloud MQTT broker contains a broken access control vulnerability in a proxy
  topic used by authenticated Tapo devices to request service tokens. The broker
  does not verify that the device ID supplied in a proxy request belongs to…
severity: high
cvss: 8.3
cvssVector: 'CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N'
cvssSource: cna
cwe:
  - CWE-862
vendor: TP-Link Systems Inc.
product: Tapo Cloud Service
affected:
  - tapo_cloud_service < N/A
published: '2026-11-03'
updated: '2026-11-03'
sourceUpdated: '2026-11-03T19:41:03.841Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-105821'
references:
  - url: 'https://www.tp-link.com/us/support/faq/5370/'
tags:
  - cve.org
epss: 0.00239
epssPercentile: 0.15159
ingestedAt: '2026-11-05T20:33:06.400Z'
---

## Overview

The Tapo
Cloud MQTT broker contains a broken access control vulnerability in a proxy
topic used by authenticated Tapo devices to request service tokens. The broker
does not verify that the device ID supplied in a proxy request belongs to the
authenticated device. An attacker who owns a Tapo device and knows another
device's ID may obtain a device token scoped to the target device and use it to
upload attacker-controlled content to the target user's Tapo Cloud storage. The
content may then be presented in the Tapo app as a legitimate event.





Successful
exploitation may allow an attacker to upload attacker-controlled content that
is presented to a target user as a legitimate Tapo event, retrieve internal
service information through crafted proxy requests, or abuse Tapo Cloud
outbound request capability in activity that could affect service
availability.

## Affected

- `tapo_cloud_service < N/A`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.