CVE-2026-111654

FastBee through 2.1.0 contains an insecure direct object reference vulnerability that allows authenticated low-privilege users to access other users' device groups because GroupController queries lack owner checks. Attackers, including self-registered users, can supply sequential group IDs to read, overwrite, reassign, rewrite device associations of, or delete other users' groups.

An attacker could exploit this vulnerability to gain unauthorized access to and modify other users' device groups, potentially leading to confidentiality, integrity, and availability breaches.

Update FastBee to a version later than 2.1.0 if available, or implement owner checks in GroupController queries to verify user permissions.