This vulnerability (CVE-2026-33359) affects Meari IoT Cloud's alert image storage service hosted on Alibaba OSS. Due to missing authorization (CWE-862), motion snapshot images can be retrieved by anyone possessing the URLs, which do not require authentication or signed access tokens and do not expire as expected. This results in unauthorized disclosure of potentially sensitive image data. The vulnerability has a CVSS 3.1 base score of 7.5, reflecting high impact on confidentiality with no required privileges or user interaction for exploitation. No vendor-provided patch or mitigation details are currently available.

The vulnerability allows unauthenticated remote attackers to access motion snapshot images stored in the cloud without any authorization checks. This leads to a high confidentiality impact as sensitive images could be exposed to unauthorized parties. There is no impact on integrity or availability reported. No known exploits in the wild have been documented.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, organizations should consider restricting access to the storage URLs through network controls or additional authentication layers if possible. Monitor for vendor updates regarding patches or configuration changes to enforce authorization and URL expiry.