CVE-2026-101104

The Meari IoT Cloud Platform OpenAPI Service has a missing-authorization flaw (CWE-862) that lets an authenticated user change the configuration of devices they do not own. It is reachable over the network with low privileges and no user interaction, because the service does not check ownership or permissions before applying changes. An attacker can alter device settings or trigger unintended device behavior, scored as high integrity impact on those devices and no direct confidentiality or availability impact on the cloud service itself. Operators and users of devices managed through this Meari cloud OpenAPI are potentially affected. There is no known public proof of concept and the CVE is not in CISA KEV, so exploitation is not known to be occurring in the wild.

What to do: Until Meari publishes a fixed OpenAPI build, treat devices managed by this cloud as reconfigurable by other authenticated platform users. Ask Meari or the device brand for a patch, limit which accounts can call device-configuration APIs, and review device logs for unexpected setting changes. No corrected version is identified in the published data.