In Meari IoT Cloud MQTT Broker deployments running EMQX 4.x, the broker enforces publish restrictions but does not enforce equivalent subscribe authorization scoped per device. This allows any authenticated low-privilege account to subscribe to global wildcard topics and receive telemetry data from devices they do not own. The issue is classified as CWE-639 (Authorization Bypass Through User-Controlled Key). The CVSS 3.1 base score is 7.7 (High), reflecting network attack vector, low attack complexity, low privileges required, no user interaction, scope change, and high impact on confidentiality.

An attacker with any authenticated low-privilege account can bypass subscription authorization controls and access telemetry data from unauthorized devices. This leads to a confidentiality breach of potentially sensitive IoT device data. There is no impact on data integrity or system availability reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or temporary mitigation is documented, organizations should monitor vendor communications for updates. In the meantime, consider restricting account creation and authentication to trusted users only and limit exposure of the MQTT broker to untrusted networks.