Vulnerability · Published Oct 16, 2026 · Assigned by VulnCheck

CVE-2026-111629IoTSharp through 3.6.1 Cross-Tenant Data Exposure via Customers and Devices APIs

Medium 4.3

In plain English

A medium-severity authorization bypass via user-controlled key in IoTSharp from IoTSharp. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 25% of all known vulnerabilities).

Severity (CVSS 3.1)4.3Medium

Exploit odds (30 days)0.3%top 75.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

IoTSharp through 3.6.1 contains an insecure direct object reference vulnerability that allows any authenticated user to read other tenants' data because Customers and Devices API handlers do not scope queries to the caller's tenant. Attackers can self-register through the anonymous AccountController.Create endpoint and supply other tenants' GUIDs to read customer contact details, device inventories and device attribute telemetry.

Affected products (as reported)

Vendor	Product	Versions
IoTSharp	IoTSharp	0 – through 3.6.1

Weakness: CWE-639 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

References

https://hackmd.io/@hieuPenguinnn/iotsharp-devices-customers-cross-tenant-idor third-party-advisory
https://github.com/IoTSharp/IoTSharp/blob/v3.6.1/IoTSharp/Controllers/CustomersController.cs#L164-L177 technical-description
https://github.com/IoTSharp/IoTSharp/blob/v3.6.1/IoTSharp/Controllers/DevicesController.cs#L490-L507 technical-description
VulnCheck Advisory: IoTSharp through 3.6.1 Cross-Tenant Data Exposure via Customers and Devices APIs third-party-advisory