The Aqara Developer Portal (developer.aqara.com) and associated test environments exhibit a permissive cross-origin resource sharing (CORS) policy that allows untrusted domains to make cross-origin requests. This is classified as CWE-942: Permissive Cross-domain Policy with Untrusted Domains. The vulnerability has a CVSS 3.1 base score of 8.2 (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N), indicating network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, high confidentiality impact, low integrity impact, and no availability impact. The affected version is explicitly stated as the 2026-04-20 release. There is no vendor advisory or patch information available, and the service is not cloud-hosted, so remediation responsibility lies with the user or vendor. No known exploits have been reported.

An attacker can exploit the permissive cross-domain policy to perform cross-origin requests from untrusted domains, potentially leading to high confidentiality breaches. The integrity impact is low, and availability is not affected. The vulnerability allows attackers to bypass same-origin policy restrictions, which can expose sensitive data or functionality to malicious websites. No known exploits are currently reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided, users should monitor the vendor's communications for updates. Until a fix is available, consider restricting access to the affected environments or implementing additional network-level controls to limit exposure. Avoid interacting with untrusted domains through the affected portals.