FastBee: Insecure direct object reference in ProductController (CVE-2026-121556)

FastBee through version 2.1.0 is affected by an insecure direct object reference (IDOR) vulnerability located in the ProductController. The application fails to properly validate the authorization of authenticated tenant users when accessing specific product resources. By supplying sequential product IDs, a malicious tenant user can access, overwrite configurations (including the tenant_id), or delete products belonging to other tenants. This unauthorized access includes the exposure of sensitive data such as MQTT accounts, passwords, and secret values.

Impact

Successful exploitation allows authenticated users to achieve unauthorized data disclosure, configuration modification, and data deletion across tenant boundaries. Sensitive information including MQTT credentials and secret keys is exposed, and unauthorized manipulation of tenant configurations can lead to service disruption or cross-tenant data compromise.

Recommendation

• Identify all instances of FastBee version 2.1.0 or earlier within the environment.
• Review vendor release notes and apply security patches as soon as they are available to remediate CVE-2026-121556.
• Until patching is possible, restrict access to the application to trusted users and implement strict input validation at the web application firewall (WAF) level to monitor for unusual patterns in product ID requests.
• Audit logs for the ProductController to identify anomalous sequences of product ID access by a single tenant user.