CVE-2026-1201

Authorization Bypass Through User-Controlled Key in Hubitat Elevation Hubs

State: Published
Severity: 9.4 Critical
Published: Jan 22, 2026
Updated: Jan 29, 2026
Reserved: Jan 19, 2026

Description

An Authorization Bypass Through User-Controlled Key vulnerability in Hubitat Elevation home automation controllers prior to version 2.4.2.157 could allow a remote authenticated user to control connected devices outside of their authorized scope via client-side request manipulation.

Scores

CVSS	Score	Vector	Source
4.0	9.4 Critical	CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H	icscert

Weaknesses

CWE-639 Authorization Bypass Through User-Controlled Key

Affected Products

Product	Versions
Elevation C3Hubitat	before 2.4.2.157Affected
Elevation C4Hubitat	before 2.4.2.157Affected
Elevation C5Hubitat	before 2.4.2.157Affected
Elevation C7Hubitat	before 2.4.2.157Affected
Elevation C8Hubitat	before 2.4.2.157Affected
Elevation C8 proHubitat	before 2.4.2.157Affected

References

https://www.cisa.gov/news-events/ics-advisories/icsa-26-022-06government-resource
https://ostrichlab.io/research-blog/?post=hubitat_writeuptechnical-descriptionrelated

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.