{"id":"CVE-2026-111629","kind":"vulnerability","aliases":["CVE-2026-111629"],"related":[],"title":"IoTSharp: any signed-up user can read other tenants' customers and devices","description":"IoTSharp through 3.6.1 contains an insecure direct object reference vulnerability that allows any authenticated user to read other tenants' data because Customers and Devices API handlers do not scope queries to the caller's tenant. Attackers can self-register through the anonymous AccountController.Create endpoint and supply other tenants' GUIDs to read customer contact details, device inventories and device attribute telemetry.","summary":"IoTSharp through 3.6.1 does not limit its Customers and Devices API queries to the caller's tenant. An attacker can self-register through the anonymous AccountController.Create endpoint, then supply other tenants' GUIDs to read their contact details, device inventories and device telemetry.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["iot","iotsharp","multi-tenant","other","self-hosted"],"not_affected_if":["closed-registration","single-tenant"],"how_to_check":"- Check the installed IoTSharp version against `3.6.1`.\n- Look for the anonymous account creation endpoint `AccountController.Create` and whether open self-registration is enabled.","fix":"- Move IoTSharp past `3.6.1` once a fixed release is published; the sources do not name a fixed version.\n- Until then, disable open self-registration and restrict who can create accounts.","status":"open","published_at":"2026-10-16T18:17:43+00:00","first_seen_at":"2026-10-23T21:57:13+00:00","triaged_at":"2026-10-25T04:27:12+00:00","updated_at":"2026-10-25T04:27:12+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-10-25T04:27:12Z","model":"claude-haiku-5-5","output":{"fix":"- Move IoTSharp past `3.6.1` once a fixed release is published; the sources do not name a fixed version.\n- Until then, disable open self-registration and restrict who can create accounts.","reach":"internet","title":"IoTSharp: any signed-up user can read other tenants' customers and devices","impact":"medium","summary":"IoTSharp through 3.6.1 does not limit its Customers and Devices API queries to the caller's tenant. An attacker can self-register through the anonymous AccountController.Create endpoint, then supply other tenants' GUIDs to read their contact details, device inventories and device telemetry.","category":"other","nicknames":[],"who_cares":["iotsharp","self-hosted","iot","multi-tenant"],"confidence":0.6,"needs_auth":"yes","worst_case":"Attacker reads other tenants' customer contacts, device inventories and telemetry.","analyst_note":"Confirm the fixed IoTSharp version and whether self-registration is on by default, using the NVD entry and the project's repository.","how_to_check":"- Check the installed IoTSharp version against `3.6.1`.\n- Look for the anonymous account creation endpoint `AccountController.Create` and whether open self-registration is enabled.","needs_analyst":true,"not_affected_if":["closed-registration","single-tenant"],"who_is_affected":"Deployments of IoTSharp through 3.6.1 that allow self-registration or have untrusted users with accounts are exposed, because any authenticated user can reach other tenants' data. Single-tenant installs with closed account creation carry much less risk. The sources do not say whether a fixed release exists.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000637,"input_tokens":3354,"output_tokens":603,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-111629':16A,19A '-2026':15A,18A '3.6.1':31B,74C 'accountcontroller.create':55B,115C 'allow':83C 'anonym':54B,114C 'api':39B,96C 'attack':47B,107C 'attribut':131C 'authent':85C 'caller':43B,104C 'contact':65B,125C 'contain':75C 'custom':11A,36B,93C,124C 'cve':14A,17A 'data':91C 'detail':66B,126C 'devic':13A,38B,67B,70B,95C,127C,130C 'direct':78C 'endpoint':56B,116C 'guid':61B,121C 'handler':97C 'host':28B 'insecur':77C 'inventori':68B,128C 'iot':20B 'iotsharp':1A,21B,29B,72C 'limit':34B 'multi':23B 'multi-ten':22B 'object':79C 'queri':40B,101C 'read':8A,63B,88C,123C 'refer':80C 'regist':51B,111C 'scope':100C 'self':27B,50B,110C 'self-host':26B 'self-regist':49B,109C 'sign':4A 'signed-up':3A 'suppli':58B,118C 'telemetri':71B,132C 'tenant':10A,24B,45B,60B,90C,106C,120C 'user':6A,86C 'vulner':81C","nicknames":[],"mitigations":[],"who_affected":"Deployments of IoTSharp through 3.6.1 that allow self-registration or have untrusted users with accounts are exposed, because any authenticated user can reach other tenants' data. Single-tenant installs with closed account creation carry much less risk. The sources do not say whether a fixed release exists.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-16T18:17:43+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111629","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111629","severity":null,"published_at":"2026-10-16T18:17:43+00:00","modified_at":"2026-10-21T21:17:53+00:00","first_seen_at":"2026-10-23T21:57:13+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}