IoTSharp through 3.6.1 contains an insecure direct object reference vulnerability that allows any authenticated user to read other tenants' data… (CVE-2026-111629)

CVE-2026-111629 describes an insecure direct object reference (IDOR) vulnerability in IoTSharp up to version 3.6.1. The flaw arises from the Customers and Devices API handlers failing to scope data queries to the caller's tenant, enabling any authenticated user to access other tenants' data. Attackers can exploit this by self-registering through the anonymous AccountController.Create endpoint and providing GUIDs of other tenants to retrieve customer contact details, device inventories, and telemetry data attributes.

The vulnerability allows unauthorized disclosure of sensitive data across tenants, including customer contact information, device inventories, and telemetry attributes. This compromises tenant data confidentiality but does not affect data integrity or availability. The CVSS score is 4.3 (medium severity), reflecting limited impact confined to information disclosure with low attack complexity and no user interaction required.

No vendor advisory or patch information is provided. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the API endpoints to trusted users and monitor for suspicious tenant ID usage. Consider disabling self-registration if possible to reduce attack surface.