Critical · 9.4 CVE-2026-1201 EUVD-2026-4204GHSA-gfwv-5762-mwrm

Authorization Bypass Through User-Controlled Key in Hubitat Elevation Hubs

Published Jan 22, 2026 · Updated Jan 29, 2026 · Assigned by icscert

Vendor: Hubitat Product: Elevation C3 Product: Elevation C4 Product: Elevation C5 Product: Elevation C7 Product: Elevation C8 Product: Elevation C8 pro

Description

An Authorization Bypass Through User-Controlled Key vulnerability in Hubitat Elevation home automation controllers prior to version 2.4.2.157 could allow a remote authenticated user to control connected devices outside of their authorized scope via client-side request manipulation.

Affected products

Vendor	Product	Affected	Fixed
Hubitat	Elevation C3	< 2.4.2.157	2.4.2.157
Hubitat	Elevation C4	< 2.4.2.157	2.4.2.157
Hubitat	Elevation C5	< 2.4.2.157	2.4.2.157
Hubitat	Elevation C7	< 2.4.2.157	2.4.2.157
Hubitat	Elevation C8	< 2.4.2.157	2.4.2.157
Hubitat	Elevation C8 pro	< 2.4.2.157	2.4.2.157

Advisories 1

ICSA-26-022-06 Hubitat Elevation Hubs CISA ICS & IT advisories · Jan 22, 2026

References

https://www.cisa.gov/news-events/ics-advisories/icsa-26-022-06 government-resource
https://ostrichlab.io/research-blog/?post=hubitat_writeup technical-description related