Meari IoT Cloud Platform OpenAPI Service

CISA published an advisory identifying authorization vulnerabilities in the Meari IoT Cloud Platform OpenAPI Service (CVE-2026-101104, CVE-2026-96613) that allow authenticated users to access or modify devices they do not own, exposing device credentials, owner information, network data, and telemetry; the issues are rated CVSS v3 7.7, affect all versions, and CISA recommends minimizing network exposure and following defensive best practices while noting no public exploitation has been reported.