CVE-2026-111684: Authorization Bypass Through User-Controlled Key in absmach magistrala

The vulnerability in absmach's Magistrala product (versions up to 1.0.0) allows authenticated users within a workspace to bypass authorization controls by using user-controlled keys such as foreign serials or entity IDs. This enables them to invoke certificate management functions—RevokeBySerial, RevokeAll, ViewCert, ListCerts, and IssueCert—on devices belonging to other tenants. Consequently, attackers can disconnect devices, disclose sensitive certificate information, and mint CA-signed certificates for device IDs they do not own.

An attacker with authenticated access can perform unauthorized certificate management actions on other tenants' devices, including revoking certificates to disconnect devices, viewing confidential certificate data, and issuing new CA-signed certificates. This compromises tenant isolation and could lead to device impersonation or denial of service within the affected environment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict authenticated user privileges to prevent unauthorized access to certificate management functions and monitor for suspicious certificate operations.