---
id: CVE-2026-121556
title: FastBee through 2.1.0 IDOR via /iot/product By-ID Endpoints
summary: >-
  FastBee through 2.1.0 contains an insecure direct object reference
  vulnerability in ProductController that allows authenticated tenant users to
  access other tenants' products by supplying their product IDs. Attackers can
  enumerate sequen…
severity: high
cvss: 8.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L'
cvssSource: cna
cwe:
  - CWE-639
vendor: beecue
product: FastBee
affected:
  - FastBee <= 2.1.0
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-11-03T16:40:56.861758Z'
published: '2026-11-03'
updated: '2026-11-03'
sourceUpdated: '2026-11-03T16:41:09.250Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-121556'
references:
  - url: 'https://github.com/beecue/FastBee/issues/32'
    label: 'GitHub Issue #32'
  - url: 'https://github.com/kerwincui/FastBee'
  - url: >-
      https://github.com/beecue/FastBee/commit/3393e3223965a9dc9682dfb2bd37635fffa0fbd2
    label: Fix commit
  - url: >-
      https://github.com/kerwincui/FastBee/blob/v2.1.0/springboot/fastbee-open-api/src/main/java/com/fastbee/data/controller/ProductController.java#L77-L141
  - url: >-
      https://github.com/kerwincui/FastBee/blob/v2.1.0/springboot/fastbee-service/fastbee-iot-service/src/main/java/com/fastbee/iot/service/impl/ProductServiceImpl.java#L72-L92
  - url: >-
      https://github.com/kerwincui/FastBee/blob/v2.1.0/springboot/fastbee-service/fastbee-iot-service/src/main/resources/mapper/iot/ProductMapper.xml#L37-L67
  - url: >-
      https://www.vulncheck.com/advisories/fastbee-through-2.1.0-idor-via-iot-product-by-id-endpoints
    label: >-
      VulnCheck Advisory: FastBee through 2.1.0 IDOR via /iot/product By-ID
      Endpoints
tags:
  - cve.org
epss: 0.00444
epssPercentile: 0.38743
ingestedAt: '2026-11-05T20:33:06.286Z'
---

## Overview

FastBee through 2.1.0 contains an insecure direct object reference vulnerability in ProductController that allows authenticated tenant users to access other tenants' products by supplying their product IDs. Attackers can enumerate sequential product IDs to read MQTT account, password, and secret values, overwrite product configuration including tenant_id, or delete products with cascading rows.

## Affected

- `FastBee <= 2.1.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.