CVEvulnerability

CVE-2026-33359

7.5 HIGH Published 2026-05-11 Modified 2026-10-26 Official page ↗

Status: Deferred
Published: 2026-05-11
Last modified: 2026-10-26
Assigner: 44488dab-36db-4358-99f9-bc116477f914
CVSS 3.1 (44488dab-36db-4358-99f9-bc116477f914): 7.5 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses: CWE-862

Description

In Meari IoT Cloud alert image storage on Alibaba OSS (latest observed; storage service version not disclosed), motion snapshots are retrievable without authentication, signed URLs, or expiry enforcement. URLs function as direct object references and remain valid beyond expected operational windows.

Weakness · CWE (1)

CWE-862 Missing Authorization weakness

References

https://github.com/xn0tsa/nobody-puts-baby-in-a-corner github.com
https://www.runzero.com/advisories/meari-unauthenticated-alert-image-access-in-cloud-object-storage-cve-2026-33359/ www.runzero.com

CVE-2026-33359

Description

Related

Weakness · CWE (1)

References