CVE-2026-50084
CWE-862Published: June 12, 2026· Updated: Jul 9, 2026
Official Description
The Aqara Cloud Production API (open-cn.aqara.com/v3.0/open/api) would authorize any valid developer token for access to any account. This is an instance of "CWE-862: Missing Authorization" with an estimated CVSS of CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N (9.6 Critical). When combined with CVE-2026-50082, CVE-50083, and CVE-50085, this can lead to a fully unauthenticated, remote takeover of affected devices.
Risk Analysis
The Aqara Cloud Production API (open-cn.aqara.com/v3.0/open/api) is critically vulnerable due to missing authorization, allowing any valid developer token to access any account. This flaw, with a CVSS score of 9.6, can lead to full compromise of confidentiality and integrity for user accounts. When combined with other vulnerabilities, it can enable unauthenticated, remote takeover of devices.
No public exploit is currently known for this vulnerability. The attack vector is network-based and has low complexity, making it remotely exploitable.
Implement strict authorization checks on the Aqara Cloud Production API to ensure developer tokens only access authorized accounts. Review and enforce the principle of least privilege for all API access.
Technical Analysis
CVE-2026-50084 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.
Exploitation requires low privileges, which limits the exposure to scenarios where an attacker has already gained initial access.
A successful exploit results in full integrity compromise (data manipulation), with a CVSS base score of 6.5.
CVSS v3.1 Vector Breakdown
Affected Vendors & Products
Exploit & PoC Resources
Official Patches & Advisories
All References (3)
Quick Facts
Related CVEs (CWE-862)
Recommended Actions
- →Apply vendor patches immediately
- →Monitor CVE-2026-50084 in threat intel feeds
- →Review IDS/IPS signatures for exploitation attempts