CVE-2026-111629

MediumCVSS 4.3/10Last modified Oct 21, 2026

Description

IoTSharp through 3.6.1 contains an insecure direct object reference vulnerability that allows any authenticated user to read other tenants' data because Customers and Devices API handlers do not scope queries to the caller's tenant. Attackers can self-register through the anonymous AccountController.Create endpoint and supply other tenants' GUIDs to read customer contact details, device inventories and device attribute telemetry.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-639

Affected software

No affected versions have been published.

Timeline

Published: Oct 16, 2026
Last modified: Oct 21, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-111639.6Use after free in Messages in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker to potentially perform a sandbox esc CVE-2026-1116305.4abp-next-admin 10.2.0 through 10.6.0 contains an insecure direct object reference vulnerability in the LINGYUN.Abp.AIManagement module that CVE-2026-1116315.4Distributor before 2.3.2 contains a missing authorization vulnerability that allows Contributor-level users to invoke external connection AJ CVE-2026-1116325.4Aureus ERP through 1.6.0 contains an authorization bypass vulnerability that allows authenticated API users to create or move records into d CVE-2026-1116338.6ZKEACMS through 4.4 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge REST API JWT bearer token CVE-2026-1116348.1Helical Insight through 7.0.0 contains an sql injection vulnerability that allows authenticated viewers to inject SQL through unescaped repo CVE-2026-1116354.3Helical Insight through 7.0.0 contains a path traversal vulnerability that allows authenticated viewers to read files outside the solution d CVE-2026-1116368.1OpenBMB StaffDeck through 0.5.6 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge administrator CVE-2026-1116375.3NexoPOS through 6.2.4 contains a missing authentication vulnerability that allows unauthenticated attackers to read accounting transaction r CVE-2026-1116387.7sshportal through 1.19.5 contains a missing authorization vulnerability in the management shell 'key show' command that allows authenticated CVE-2026-1116398.1bbs-go through 4.4.6 contains an authentication bypass vulnerability in the /api/login/google_one_tap endpoint that allows remote attackers CVE-2026-111648.8Use after free in Blink in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a c