Live › vulnerability › CVE-2026-111629
Go to dashboardIoTSharp through 3.6.1 does not limit its Customers and Devices API queries to the caller's tenant. An attacker can self-register through the anonymous AccountController.Create endpoint, then supply other tenants' GUIDs to read their contact details, device inventories and device telemetry.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Deployments of IoTSharp through 3.6.1 that allow self-registration or have untrusted users with accounts are exposed, because any authenticated user can reach other tenants' data. Single-tenant installs with closed account creation carry much less risk. The sources do not say whether a fixed release exists.
No product ranges from the sources yet.
3.6.1.AccountController.Create and whether open self-registration is enabled.3.6.1 once a fixed release is published; the sources do not name a fixed version.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
IoTSharp through 3.6.1 contains an insecure direct object reference vulnerability that allows any authenticated user to read other tenants' data because Customers and Devices API handlers do not scope queries to the caller's tenant. Attackers can self-register through the anonymous AccountController.Create endpoint and supply other tenants' GUIDs to read customer contact details, device inventories and device attribute telemetry.
This page as .md · .json · in your agent: get_signal("CVE-2026-111629")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.