Unauthenticated attackers can obtain restricted information about a user's smart device collections (i.e., "scenes").
CWE-639