Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.4
CVE-2026-1201: Hubitat Elevation: Remote users can control unauthorized devices
CVE-2026-1201 · published 9 months ago
Summary
A security issue in older versions of Hubitat Elevation home automation controllers allows a remote user who has logged in to potentially control devices they shouldn't have access to. This is a concern because it could let someone take control of your smart home systems without your permission. Update to version 2.4.2.157 or later to fix the issue.
Original advisory text
An Authorization Bypass Through User-Controlled Key vulnerability in Hubitat Elevation home automation controllers prior to version 2.4.2.157 could allow a remote authenticated user to control conn...
An Authorization Bypass Through User-Controlled Key vulnerability in Hubitat Elevation home automation controllers prior to version 2.4.2.157 could allow a remote authenticated user to control connected devices outside of their authorized scope via client-side request manipulation.
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker full control
Type
CWE-639Authorization Bypass Through User-Controlled Key
Timeline
Published22 Jan 2026
Updated30 Oct 2026
First seen7 Mar 2026
Sources
CVE-2026-1201 · NVD
Track software like this
Free during beta