# CVE-2026-33359: Meari IoT Cloud missing authorization in Alibaba OSS image storage

Source: https://junglewise.ai/threats/cve-2026-33359-meari-iot-cloud-missing-authorization-in-alibaba-oss-image  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-11. Updated: 2026-05-11  
License: CC BY 4.0 with a link back

CVE-2026-33359 · Severity: high · CVSS 7.5 · Published 2026-05-11

Meari IoT Cloud, a platform used for smart home and baby monitor cameras, fails to properly secure motion alert images stored in the cloud. An unauthorized person who obtains a direct link to an image can view it without a password, and these links do not expire. This allows for the persistent exposure of private indoor photos, including sensitive images from baby monitors, even if the user changes their account credentials.

Vendors: [Meari](https://junglewise.ai/threats/vendors/meari).

## Quick answers

**Is CVE-2026-33359 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-33359 being exploited in the wild.

**How severe is CVE-2026-33359?** High severity, with a CVSS score of 7.5, published 11 May 2026.

**Which products and versions are affected?** Meari IoT Cloud Latest observed as of April 2026.

**Is there a fix for CVE-2026-33359?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-33359 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-33359?** Check whether you run Meari IoT Cloud at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a case of missing authorization (CWE-862) within the Meari IoT Cloud's implementation of Alibaba OSS storage. Motion snapshots are stored using predictable or discoverable direct object references that do not require authentication or signed URLs for access. Furthermore, the storage service does not enforce expiry on these URLs, meaning they remain valid indefinitely. An attacker who obtains these URLs (potentially through other vulnerabilities like CVE-2026-33356) can retrieve private visual data without needing an active session or account access. This issue is particularly severe given the product's use in baby monitors and indoor security cameras.

## Affected products

- Meari IoT Cloud alert image storage on Alibaba OSS Latest observed as of April 2026

## Timeline

- 2026-03-11: disclosed: Issues identified by researcher and disclosed to vendor
- 2026-04-03: other: VINCE Case VU#579666 opened with CISA
- 2026-05-11: advisory: Public disclosure of vulnerability

## References

- [https://github.com/xn0tsa/nobody-puts-baby-in-a-corner](https://github.com/xn0tsa/nobody-puts-baby-in-a-corner)
- [https://www.runzero.com/advisories/meari-unauthenticated-alert-image-access-in-cloud-object-storage-cve-2026-33359/](https://www.runzero.com/advisories/meari-unauthenticated-alert-image-access-in-cloud-object-storage-cve-2026-33359/)