CVE-2026-111629
IoTSharp through 3.6.1 Cross-Tenant Data Exposure via Customers and Devices APIs
CVSS Score
4.3
EPSS Score
0.0%
EPSS Percentile
0th
IoTSharp through 3.6.1 contains an insecure direct object reference vulnerability that allows any authenticated user to read other tenants' data because Customers and Devices API handlers do not scope queries to the caller's tenant. Attackers can self-register through the anonymous AccountController.Create endpoint and supply other tenants' GUIDs to read customer contact details, device inventories and device attribute telemetry.
| CWE | CWE-639 |
| Vendor | iotsharp |
| Product | iotsharp |
| Published | Oct 16, 2026 |
Stay Ahead of the Next One
Get instant alerts for iotsharp iotsharp
Be the first to know when new medium vulnerabilities affecting iotsharp iotsharp are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
None
Availability
None
Affected Versions
IoTSharp / IoTSharp
0 ≤ 3.6.1
References
hackmd.io: https://hackmd.io/@hieuPenguinnn/iotsharp-devices-customers-cross-tenant-idor github.com: https://github.com/IoTSharp/IoTSharp/blob/v3.6.1/IoTSharp/Controllers/CustomersController.cs#L164-L177 github.com: https://github.com/IoTSharp/IoTSharp/blob/v3.6.1/IoTSharp/Controllers/DevicesController.cs#L490-L507 vulncheck.com: https://www.vulncheck.com/advisories/iotsharp-through-3.6.1-cross-tenant-data-exposure-via-customers-and-devices-apis
Credits
hieuPenguinnn