The Meari IoT Cloud Platform OpenAPI Service suffers from a missing authorization control (CWE-862) that allows any authenticated user to retrieve the complete device shadow of arbitrary devices by specifying their device IDs. This bypasses intended access restrictions and exposes sensitive device-related information such as credentials, ownership, network configuration, and telemetry. The vulnerability is rated high severity with a CVSS 4.0 score of 7.1 (Network attack vector, low attack complexity, no privileges required beyond authentication, high impact on confidentiality). No vendor advisory or patch information is currently available.

Exploitation of this vulnerability allows an authenticated user to access sensitive information of any device managed by the platform without authorization. This can lead to exposure of device credentials, owner details, network data, and telemetry, potentially enabling further attacks or privacy violations. There is no indication of integrity or availability impact. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the OpenAPI service to trusted users only and monitor for unauthorized access attempts. Implement additional access controls or compensating controls if possible.