CVE-2026-50088 describes a vulnerability in the Aqara Developer Portal and associated test environments where a permissive cross-origin resource sharing (CORS) policy allows untrusted domains to make cross-origin requests. This is an instance of CWE-942: Permissive Cross-domain Policy with Untrusted Domains. The vulnerability has a CVSS 3.1 score of 8.2 (High), with network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, high confidentiality impact, low integrity impact, and no availability impact. The affected version is identified as 2026-04-20. There is no vendor advisory or patch information available at this time.

The vulnerability allows untrusted domains to perform cross-origin requests against the Aqara Developer Portal and its test environments, potentially leading to high confidentiality loss and some integrity compromise. This could expose sensitive data or allow limited unauthorized actions. There is no impact on availability. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution when interacting with the affected services and avoid exposing sensitive information through these portals. Monitor vendor communications for updates on remediation.