{"affected":[{"defaultStatus":"unaffected","product":"Tapo Cloud Service","source":"CNA: TPLink","vendor":"TP-Link Systems Inc.","versions":[{"lessThan":"N/A","status":"affected","version":"0","versionType":"custom"}]}],"cveId":"CVE-2026-105821","cwes":["CWE-862"],"description":"The Tapo\nCloud MQTT broker contains a broken access control vulnerability in a proxy\ntopic used by authenticated Tapo devices to request service tokens. The broker\ndoes not verify that the device ID supplied in a proxy request belongs to the\nauthenticated device. An attacker who owns a Tapo device and knows another\ndevice's ID may obtain a device token scoped to the target device and use it to\nupload attacker-controlled content to the target user's Tapo Cloud storage. The\ncontent may then be presented in the Tapo app as a legitimate event.\n\n\n\n\n\nSuccessful\nexploitation may allow an attacker to upload attacker-controlled content that\nis presented to a target user as a legitimate Tapo event, retrieve internal\nservice information through crafted proxy requests, or abuse Tapo Cloud\noutbound request capability in activity that could affect service\navailability.","epss":null,"exploits":[],"kev":null,"metrics":[{"score":8.3,"severity":"high","source":"CNA: TPLink","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N","version":"4.0"}],"modifiedAt":1793734863841,"publishedAt":1793734863841,"references":[{"source":"CNA: TPLink","tags":["vendor-advisory"],"url":"https://www.tp-link.com/us/support/faq/5370/"}],"remediation":[],"revision":"5f7778bdfda0ffb04acb3691dffdca8d6e54ed488c006ff39ade823fdb5f6039","sources":[{"modifiedAt":1793734863841,"name":"CNA: TPLink","retrievedAt":1793736506124,"url":"https://www.cve.org/CVERecord?id=CVE-2026-105821"}],"ssvc":null,"status":"published","title":"Broken Access Control Leading to Cross-Device Token Issuance in Tapo Cloud MQTT Proxy","updatedAt":1793736506124}