CVE-2026-1201

CriticalCVSS 9.4/10Last modified Jun 17, 2026

Description

An Authorization Bypass Through User-Controlled Key vulnerability in Hubitat Elevation home automation controllers prior to version 2.4.2.157 could allow a remote authenticated user to control connected devices outside of their authorized scope via client-side request manipulation.

Metrics

CVSS 4.0 9.4/10

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-639

Affected software

Vendor	Product	Versions
Hubitat	Elevation C3	< 2.4.2.157
Hubitat	Elevation C4	< 2.4.2.157
Hubitat	Elevation C5	< 2.4.2.157
Hubitat	Elevation C7	< 2.4.2.157
Hubitat	Elevation C8	< 2.4.2.157
Hubitat	Elevation C8 pro	< 2.4.2.157

References

Timeline

Published: Jan 22, 2026
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-120108.3Heap buffer overflow in GPU in Google Chrome on Android prior to 149.0.7827.115 allowed a remote attacker who had compromised the renderer p CVE-2026-120118.3Use after free in WebMIDI in Google Chrome on Windows prior to 149.0.7827.115 allowed a remote attacker who had compromised the renderer pro CVE-2026-1201136.4IBM Aspera Connect 1.6.1 through 4.2.19 could allow a remote attacker to obtain sensitive information and modify host trust configuration du CVE-2026-1201147.2The Debug Log Manager – Conveniently Monitor and Inspect Errors plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'm CVE-2026-1201156.3IBM Aspera Connect 1.6.1 through 4.2.19 fails to consistently enforce origin verification across all REST API endpoints. An attacker who con CVE-2026-120128.1Use after free in Network in Google Chrome prior to 149.0.7827.115 allowed an attacker in a privileged network position to potentially explo CVE-2026-1201358.2Uncontrolled Recursion vulnerability in Apache Thrift Java bindings. This issue affects Apache Thrift: before 0.24.0. Users are recomm CVE-2026-1201398.8Integer wraparound in PostgreSQL in-memory tuple-size calculations allows a database user to execute arbitrary code as the operating system CVE-2026-120148.3Use after free in Cast in Google Chrome prior to 149.0.7827.115 allowed an attacker on the local network segment to potentially perform a sa CVE-2026-1201418.8Type confusion in PostgreSQL materialized set-returning functions allows a database user to execute arbitrary code as the operating system u CVE-2026-1201428.8Type confusion in PostgreSQL anonymous RECORD types allows an object creator to execute arbitrary code as the operating system user running CVE-2026-1201438.8Use after free in PostgreSQL trigger functions allows an object creator to execute arbitrary code as the operating system user running the d