Threats tagged 'ghsa-xvx6-5cj7-5p8g'

FastBee versions through 2.1.0 have an insecure direct object reference (IDOR) vulnerability in the ProductController. Authenticated tenant users can exploit this flaw to access products belonging to other tenants by providing their product IDs. This allows attackers to enumerate sequential product IDs to read sensitive MQTT credentials, modify product configurations including tenant identifiers, or delete products along with related data.