Answer in brief
CVE-2026-96613 records a High severity (CVSS 7.1) vulnerability in Missing Authorization in Meari IoT Cloud Platform OpenAPI Service. The current sources do not mark it as known exploited. The current feed maps Meari/IoT Cloud Platform OpenAPI Service (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 7.1. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Meari/IoT Cloud Platform OpenAPI Service (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Meari/IoT Cloud Platform OpenAPI Servicegeneric | All verisons | Not reported |
Published upstream
Oct 2, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Oct 2, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Oct 2, 2026
The Meari IoT Cloud Platform OpenAPI Service is vulnerable to an authorization flaw that allows authenticated users to access the complete device shadow of any device by specifying its device ID. This vulnerability exposes sensitive information, such as device credentials, owner details, network data, and telemetry, without verifying any relationship between the requester and the target device.
Quoted source text, attributed separately from HOL analysis.