Is CVE-2026-96613 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-96613 being exploited in the wild.

How severe is CVE-2026-96613?

Medium severity, with a CVSS score of 6.5, published 2 October 2026.

Which products and versions are affected?

Meari IoT Cloud Platform OpenAPI Service all versions.

Is there a fix for CVE-2026-96613?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-96613 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-96613?

Check whether you run Meari IoT Cloud Platform OpenAPI Service at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-96613: Meari IoT Cloud Platform OpenAPI missing authorization

CVE-2026-96613 · Severity: medium · CVSS 6.5 · Published 2026-10-02

The Meari IoT Cloud Platform OpenAPI Service, which manages connected smart home and IoT devices, contains a flaw that allows authenticated users to read sensitive data from any device in the system. An attacker with valid login credentials can access device passwords, owner information, and network details without owning those devices, leading to account takeover, device compromise, and privacy violations across the customer base.

Vendors: Meari.

Quick answers

Is CVE-2026-96613 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-96613 being exploited in the wild.
How severe is CVE-2026-96613?: Medium severity, with a CVSS score of 6.5, published 2 October 2026.
Which products and versions are affected?: Meari IoT Cloud Platform OpenAPI Service all versions.
Is there a fix for CVE-2026-96613?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-96613 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-96613?: Check whether you run Meari IoT Cloud Platform OpenAPI Service at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a missing authorization check (CWE-862) in the OpenAPI Service's device shadow retrieval endpoint. An authenticated user can specify any device ID and retrieve complete device configuration and credentials without verification that the user owns or has permission to access that device. The attack requires valid authentication credentials but no special privileges or user interaction.

Affected products

Meari IoT Cloud Platform OpenAPI Service all versions

Timeline

2026-10-01: disclosed: CISA advisory ICSA-26-274-06 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.