CVE-2026-1201
CriticalSummary
An Authorization Bypass Through User-Controlled Key vulnerability in Hubitat Elevation home automation controllers prior to version 2.4.2.157 could allow a remote authenticated user to control connected devices outside their authorized scope via client-side request manipulation.
Risk Assessment
An authenticated user can control devices they are not authorized for, potentially leading to unauthorized home access or privacy breaches.
Recommendation
Update Hubitat Elevation to version 2.4.2.157 or later and avoid trusting client-supplied data for authorization.
Original NVD description (English source)
An Authorization Bypass Through User-Controlled Key vulnerability in Hubitat Elevation home automation controllers prior to version 2.4.2.157 could allow a remote authenticated user to control connected devices outside of their authorized scope via client-side request manipulation.