CISA warns of authorization flaws in Meari IoT platform
A CISA advisory published October 1, 2026, reports two flaws in Meari’s OpenAPI service that allow unauthorized device changes and sensitive data exposure. All versions are affected, with no fix planned.
Source: Meari IoT Cloud Platform OpenAPI Service: falhas de autorização expõem dados e permitem alterações (cisa.gov). Text prepared with AI from this source.
What happened and what to do
In an advisory published October 1, 2026, CISA reports two authorization flaws in the Meari IoT Cloud Platform OpenAPI Service, affecting all versions. CVE-2026-101104 allows authenticated users to change settings on devices they do not own and trigger unauthorized behavior. CVE-2026-96613 allows access to any device’s data by specifying its identifier, including credentials, owner information, network data, and telemetry. Their CVSS 3.1 scores are 7.7 and 6.5, respectively. The advisory states that no fix is planned and that Meari did not respond to CISA’s coordination attempts.
Companies using the platform can inventory integrations and devices, restrict API access, review records of queries and changes, and assess possible exposure of credentials or data. They can also prepare containment measures and follow up with the vendor on support options, without assuming the flaw has been fixed.
How the consultancy can help
Wendelmaques can diagnose exposure, map integrations and data flows, and propose access controls, monitoring, and response measures. The engagement can include implementation and operation of a solution scoped to the environment and identified risks.
Next step
Send a short description of your platform use and related integrations to receive a scoped proposal for diagnosis and implementation.
Let's assess your project
I reply with scope and a proposal.