CVE-2026-66060 is a missing authorization vulnerability (CWE-862) in Home Assistant core's Companion app before version 2026.8.1. The app treats NFC or QR tag links delivered through an OS-level routing mechanism as if physically scanned, without validating the calling application or prompting the user. This flaw enables any untrusted app on the device to forward arbitrary tags to Home Assistant, causing it to execute the associated automation as if a legitimate user had scanned an authorized tag. This results in silent and unattended execution of automations by untrusted local callers. The issue is fixed in Home Assistant core version 2026.8.1.

An attacker with access to the local device can cause Home Assistant to execute automations without user consent or interaction by forwarding arbitrary tag data. This can lead to unauthorized automation execution, potentially impacting system integrity or user environment control. There is no confidentiality or availability impact reported. The CVSS 3.1 base score is 7.1 (high), reflecting local attack vector, low complexity, no privileges required, no user interaction, and impact on integrity.

Upgrade Home Assistant core to version 2026.8.1 or later where this authorization issue is fixed. Until then, restrict untrusted apps from interacting with the Companion app's tag handling features. No official remediation level is stated, so check the vendor advisory for updates.