IoTSharp CVE-2026-111629

Requires an authenticated low-privilege account, which is trivially obtainable because the AccountController.Create endpoint permits anonymous self-registration. Beyond that, the attacker must know or obtain valid GUIDs belonging to other tenants to pass to the Customers and Devices API handlers, since the handlers fail to scope queries to the caller's tenant. Limiting factors: GUIDs are not sequentially enumerable (random 128-bit identifiers), so blind mass enumeration is impractical and exploitation is realistically targeted; the deployment must be genuinely multi-tenant with other tenants' customer/device data present for there to be anything to steal. Exploitation is read-only with no integrity or availability impact.

This is a medium-severity cross-tenant IDOR (CWE-639) with genuinely mixed signals that place it well below drop-everything priority. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) confirms network-reachable, low-complexity exploitation, but PR:L means a valid account is required - and the practical barrier is low because the AccountController.Create endpoint permits anonymous self-registration, effectively turning PR:L into 'anyone who can reach the app.' Impact is bounded: VC:L/VI:N/VA:N reflects read-only exposure with no integrity or availability effect, and the realistic confidentiality impact is further constrained because an attacker must supply valid other-tenant GUIDs, which are not sequentially enumerable, limiting bulk harvesting to targeted abuse rather than automated mass exfiltration. No EPSS score was provided in the input, so exploitation probability cannot be quantified; the vulnerability is NOT listed in CISA KEV, and no exploit-code flag was supplied, so this is no public exploit identified at time of analysis - though a detailed third-party technical writeup (hackmd) and exact vulnerable source lines (CustomersController.cs:164-177, DevicesController.cs:490-507) are publicly referenced, meaning rediscovery/weaponization is trivial for a motivated actor. No SSVC decision data was provided. Net: a real but contained authorization flaw - prioritize patching in multi-tenant IoTSharp deployments holding sensitive customer/device data, but it does not represent RCE-class or mass-exploitation urgency.

An attacker self-registers a low-privilege account via the anonymous AccountController.Create endpoint, then calls the Customers and Devices API handlers while supplying a GUID belonging to a different tenant. Because the handlers never scope queries to the caller's tenant, the attacker receives that tenant's customer contact details, device inventory, and device attribute telemetry. A public technical writeup documents the exact exploitation path, lowering the barrier despite no formal exploit-code flag.