CVE-2026-111629
Received Received - Intake

Insecure Direct Object Reference in IoTSharp Exposes Tenant Data

Publication date: 2026-10-16

Last updated on: 2026-10-16

Assigner: VulnCheck

Description
IoTSharp through 3.6.1 contains an insecure direct object reference vulnerability that allows any authenticated user to read other tenants' data because Customers and Devices API handlers do not scope queries to the caller's tenant. Attackers can self-register through the anonymous AccountController.Create endpoint and supply other tenants' GUIDs to read customer contact details, device inventories and device attribute telemetry.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-16
Last Modified
2026-10-16
Generated
2026-10-16
AI Q&A
2026-10-16
EPSS Evaluated
N/A
NVD
CVE-2026-111629
EUVD
EUVD-2026-103051

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
IoTSharp IoTSharp 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-111629 is an insecure direct object reference (IDOR) vulnerability in IoTSharp through version 3.6.1. It allows authenticated users to access other tenants' data because the Customers and Devices API handlers do not properly scope queries to the caller's tenant. Attackers can self-register and supply other tenants' GUIDs to read sensitive information like customer contact details, device inventories, and device telemetry.

Detection Guidance

To detect this vulnerability, check for unauthorized access to tenant-specific data in IoTSharp APIs. Monitor API logs for requests to /Customers or /Devices endpoints with abnormal tenant GUIDs. Use tools like Burp Suite or Postman to send test requests with different tenant IDs and verify if data from other tenants is returned. Look for missing tenant scoping in API responses.

Impact Analysis

This vulnerability allows unauthorized access to other tenants' sensitive data, including customer personally identifiable information (PII), device inventories, and device telemetry. Attackers can exploit it by creating a normal user account and querying vulnerable APIs to retrieve data from other tenants without proper authorization.

Compliance Impact

This vulnerability likely violates compliance requirements for data protection standards like GDPR and HIPAA, which mandate strict access controls and tenant isolation for sensitive data. Unauthorized cross-tenant data exposure could result in regulatory penalties, reputational damage, and legal consequences due to non-compliance with data privacy and security mandates.

Mitigation Strategies

Immediately update IoTSharp to a patched version beyond 3.6.1. If updating is not possible, restrict access to the vulnerable API endpoints by implementing tenant scoping checks in the Customers and Devices controllers. Ensure all API handlers validate JWT claims for tenant ownership before processing requests. Disable anonymous self-registration if not required.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-111629. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart