CVE-2026-111629 Details

A cross-tenant insecure direct object reference vulnerability has been identified in IoTSharp versions through 3.6.1. This vulnerability allows authenticated users to access data from other tenants because the Customers and Devices API handlers do not restrict queries to the user's tenant. Attackers can exploit this by self-registering through the AccountController.Create endpoint and using other tenants' GUIDs to access customer contact information, device inventories, and device attribute telemetry.

The vulnerability can be addressed by adding tenant and customer scoping to the affected API handlers, implementing a global query filter at the database level to enforce tenant isolation, and adding regression tests to ensure cross-tenant access is not possible.