CVE-2026-111654: Authorization Bypass Through User-Controlled Key in kerwincui FastBee

CVE-2026-111654 describes an authorization bypass vulnerability in kerwincui's FastBee product through version 2.1.0. The flaw arises from missing owner checks in GroupController queries, enabling authenticated low-privilege users, including self-registered users, to access and manipulate device groups owned by others. Attackers can supply sequential group IDs to perform unauthorized read, overwrite, reassignment, and deletion operations on device groups.

The vulnerability allows unauthorized access and modification of device groups belonging to other users. This can lead to unauthorized data exposure, data tampering, and potential disruption of device associations managed within FastBee. The CVSS 4.0 base score is 5.3 (medium severity), reflecting network attack vector, low attack complexity, no user interaction, and low to low integrity and availability impacts.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to trusted users and monitor for suspicious activity related to group ID manipulation. Avoid exposing sequential group IDs in user-accessible contexts.