CVE-2026-111629

IoTSharp through 3.6.1 contains an insecure direct object reference vulnerability that allows any authenticated user to read other tenants' data because Customers and Devices API handlers do not scope queries to the caller's tenant. Attackers can self-register through the anonymous AccountController.Create endpoint and supply other tenants' GUIDs to read customer contact details, device inventories and device attribute telemetry.

CVSS v3 4.3 MEDIUM

4.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/IoTSharp/IoTSharp/blob/v3.6.1/IoTSharp/Controllers/CustomersController.cs#L164-L177
https://github.com/IoTSharp/IoTSharp/blob/v3.6.1/IoTSharp/Controllers/DevicesController.cs#L490-L507
https://hackmd.io/@hieuPenguinnn/iotsharp-devices-customers-cross-tenant-idor
https://www.vulncheck.com/advisories/iotsharp-through-3.6.1-cross-tenant-data-exposure-via-customers-and-devices-apis
https://hackmd.io/@hieuPenguinnn/iotsharp-devices-customers-cross-tenant-idor

Configurations

No configuration.

History

21 Oct 2026, 21:17

Type	Values Removed	Values Added
References	~~() https://hackmd.io/@hieuPenguinnn/iotsharp-devices-customers-cross-tenant-idor -~~	() https://hackmd.io/@hieuPenguinnn/iotsharp-devices-customers-cross-tenant-idor -

16 Oct 2026, 18:17

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-10-16 18:17

Updated : 2026-10-21 21:17

NVD link : CVE-2026-111629

Mitre link : CVE-2026-111629

CVE.ORG link : CVE-2026-111629

JSON object : View

Products Affected

No product.

CWE

CWE-639

Authorization Bypass Through User-Controlled Key

{"id": "CVE-2026-111629", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-111629", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-21T20:42:54.521610Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 2.8}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 5.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"repo": "https://github.com/IoTSharp/IoTSharp", "vendor": "IoTSharp", "product": "IoTSharp", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "3.6.1"}], "packageURL": "pkg:github/IoTSharp/IoTSharp", "defaultStatus": "unaffected"}]}], "published": "2026-10-16T18:17:43.043", "references": [{"url": "https://github.com/IoTSharp/IoTSharp/blob/v3.6.1/IoTSharp/Controllers/CustomersController.cs#L164-L177", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/IoTSharp/IoTSharp/blob/v3.6.1/IoTSharp/Controllers/DevicesController.cs#L490-L507", "source": "disclosure@vulncheck.com"}, {"url": "https://hackmd.io/@hieuPenguinnn/iotsharp-devices-customers-cross-tenant-idor", "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/iotsharp-through-3.6.1-cross-tenant-data-exposure-via-customers-and-devices-apis", "source": "disclosure@vulncheck.com"}, {"url": "https://hackmd.io/@hieuPenguinnn/iotsharp-devices-customers-cross-tenant-idor", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-639"}]}], "descriptions": [{"lang": "en", "value": "IoTSharp through 3.6.1 contains an insecure direct object reference vulnerability that allows any authenticated user to read other tenants' data because Customers and Devices API handlers do not scope queries to the caller's tenant. Attackers can self-register through the anonymous AccountController.Create endpoint and supply other tenants' GUIDs to read customer contact details, device inventories and device attribute telemetry."}], "lastModified": "2026-10-21T21:17:53.290", "sourceIdentifier": "disclosure@vulncheck.com"}