CVE-2026-120274

FastBee through 2.1.0 contains an insecure direct object reference vulnerability that allows authenticated low-privilege users to access other users' device groups because GroupController queries lack owner checks. Attackers, including self-registered users, can supply sequential group IDs to read, overwrite, reassign, rewrite device associations of, or delete other users' groups.

FastBee through 2.1.0 contains an insecure direct object reference vulnerability in DeviceController that allows authenticated low-privilege users to read and modify other tenants' devices by supplying sequential device IDs.

A vulnerability was determined in kerwincui FastBee up to 1.2.1 in the Add function of SysNoticeController.java within the System Notice Handler. Manipulating the noticeContent argument causes cross-site scripting. The attack can be initiated remotely, the exploit has been publicly disclosed and may be utilized, and the vendor did not respond.

In kerwincui FastBee up to 1.2.1, the ToolController.download function in ToolController.java of the Tool Download Endpoint component, when manipulating the fileName argument, leads to path traversal. The attack can be performed remotely and the exploit has been publicly disclosed. The vendor did not respond to the disclosure.