CVE-2026-111629
IoTSharp through 3.6.1 Cross-Tenant Data Exposure via Customers and Devices APIs
- State
- Published
- Severity
- 5.3 Medium
- Published
- Oct 16, 2026
- Updated
- Oct 21, 2026
- Reserved
- Oct 16, 2026
Description
IoTSharp through 3.6.1 contains an insecure direct object reference vulnerability that allows any authenticated user to read other tenants' data because Customers and Devices API handlers do not scope queries to the caller's tenant. Attackers can self-register through the anonymous AccountController.Create endpoint and supply other tenants' GUIDs to read customer contact details, device inventories and device attribute telemetry.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 5.3 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 4.3 Medium | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N | VulnCheck |
Weaknesses
- CWE-639 Authorization Bypass Through User-Controlled Key
Affected Products
| Product | Versions |
|---|---|
IoTSharpIoTSharp |
|
References
- https://hackmd.io/@hieuPenguinnn/iotsharp-devices-customers-cross-tenant-idorthird-party-advisory
- https://github.com/IoTSharp/IoTSharp/blob/v3.6.1/IoTSharp/Controllers/CustomersController.cs#L164-L177technical-description
- https://github.com/IoTSharp/IoTSharp/blob/v3.6.1/IoTSharp/Controllers/DevicesController.cs#L490-L507technical-description
- VulnCheck Advisory: IoTSharp through 3.6.1 Cross-Tenant Data Exposure via Customers and Devices APIsthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.