FastBee versions up to 2.1.0 contain an insecure direct object reference that lets authenticated low-privilege users manipulate device group data belonging to other users. By calling the /iot/group By-ID endpoints with sequential group identifiers, a malicious actor can read, overwrite, reassign, rewrite device associations, or delete groups owned by distinct users, effectively compromising isolation between tenants and allowing data tampering or denial of service within the affected system.

The vulnerability affects the FastBee platform developed by kerwincui. All deployments running FastBee up to and including version 2.1.0 are impacted; no earlier or subsequent version information was provided.

The vulnerability has a CVSS score of 5.3, indicating a medium severity. EPSS data is unavailable, and the issue is not listed in CISA KEV. The attack vector is inferred to be the REST API, requiring authenticated access with low privileges. An attacker can exploit the flaw by enumerating group IDs, thus the risk is moderate when an authenticated account exists, but it is mitigated by not being publicly exploitable without credentials.