---
id: "CVE-2026-111629"
kind: "vulnerability"
aliases: ["CVE-2026-111629"]
title: "IoTSharp: any signed-up user can read other tenants' customers and devices"
severity: "medium"
cvss: 5.3
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["iot", "iotsharp", "multi-tenant", "other", "self-hosted"]
not_affected_if: ["closed-registration", "single-tenant"]
published_at: "2026-10-16T18:17:43+00:00"
first_seen_at: "2026-10-23T21:57:13+00:00"
updated_at: "2026-10-25T04:27:12+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111629", "first_seen_at": "2026-10-23T21:57:13+00:00"}]
---

# IoTSharp: any signed-up user can read other tenants' customers and devices

IoTSharp through 3.6.1 does not limit its Customers and Devices API queries to the caller's tenant. An attacker can self-register through the anonymous AccountController.Create endpoint, then supply other tenants' GUIDs to read their contact details, device inventories and device telemetry.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed IoTSharp version against `3.6.1`.
- Look for the anonymous account creation endpoint `AccountController.Create` and whether open self-registration is enabled.

## Fix

- Move IoTSharp past `3.6.1` once a fixed release is published; the sources do not name a fixed version.
- Until then, disable open self-registration and restrict who can create accounts.

## Timeline

- 2026-10-23T21:57:13+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-111629

## From the sources

IoTSharp through 3.6.1 contains an insecure direct object reference vulnerability that allows any authenticated user to read other tenants' data because Customers and Devices API handlers do not scope queries to the caller's tenant. Attackers can self-register through the anonymous AccountController.Create endpoint and supply other tenants' GUIDs to read customer contact details, device inventories and device attribute telemetry.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_