CVE-2026-110124: Authorization Bypass Through User-Controlled Key in kerwincui FastBee
Description
CVE-2026-110124 is an authorization bypass vulnerability in kerwincui FastBee versions up to 2.1.0. It allows authenticated low-privilege users to access and modify devices belonging to other tenants by manipulating device identifiers. Attackers can enumerate device IDs or serial numbers to obtain sensitive information such as owner, IP, and location data, and can overwrite user and tenant identifiers to take control of devices.
CVSS v4.0
Score 8.6high
Affected software
kerwincui
FastBee
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
FastBee through version 2.1.0 contains an insecure direct object reference vulnerability in its DeviceController component. This flaw permits authenticated users with low privileges to bypass authorization controls by supplying sequential device IDs. Exploiting this, attackers can enumerate deviceId or serialNumber values to read sensitive device information including owner, IP address, and location. Furthermore, they can overwrite user_id and tenant_id fields to assume control over devices belonging to other tenants.
Potential Impact
The vulnerability enables unauthorized access and modification of devices across tenant boundaries. Attackers can enumerate device identifiers to gather sensitive information and potentially take over devices by changing ownership and tenant associations. This poses significant confidentiality and integrity risks to affected tenants.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to authenticated users and monitor for suspicious activity related to device enumeration or modification attempts.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-10-13T16:24:39.155Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6ace64982cdf04f6568af12e
Added to database: 10/13/2026, 17:04:24 UTC
Last enriched: 10/13/2026, 17:18:27 UTC
Last updated: 10/13/2026, 21:57:01 UTC
Views: 7
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.