EUVD-2026-102975
GHSA-vh76-85cj-956g
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as low-privilege workspace member
-
DeliveryEnumerate foreign device IDs/cert serials
-
ExploitCall certs API with foreign identifiers under own workspace path
-
ExecutionIssue/view/revoke cross-tenant certificates
-
ImpactDisconnect victim devices and impersonate device IDs
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Object-level authorization, IDOR prevention
|
| Exploitation Conditions | Exploitation requires a valid authenticated account that is a member of at least one workspace/tenant on the target Magistrala instance (PR:L) - it is not pre-authentication. The core precondition is multi-tenant usage of the certs service: the attacker invokes RevokeBySerial, RevokeAll, ViewCert, ListCerts, or IssueCert under their own workspace path while supplying another tenant's certificate serials or entity/device IDs, which the service does not validate against the caller's workspace scope. Limiting factors: the attacker must already possess workspace credentials and must know or enumerate foreign device IDs/serials; a single-tenant deployment or one where certs issuance is unused greatly reduces practical impact. No special non-default feature toggle is named in the description beyond use of the certificate service itself. |
| Impact | This is a credible, above-average-priority issue but not an emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) indicates a network-reachable, low-complexity flaw requiring only low privileges - i.e., any legitimate authenticated workspace member (tenant) - and no user interaction, which is a realistic insider/tenant-abuse profile for a multi-tenant IoT platform. Impact is weighted toward integrity and availability (VI:H/VA:H) with low confidentiality (VC:L), consistent with the ability to mint CA-signed certificates and disconnect other tenants' devices while only partially disclosing certificate data. No EPSS score was provided, no CISA KEV listing is present, and no explicit public exploit-code flag is in the input, so there is no signal of active or widespread exploitation; however, a detailed third-party technical write-up (hackmd) and a VulnCheck advisory with precise vulnerable source lines effectively lower the barrier to reproduction. Net: treat as a real priority for anyone running Magistrala in a shared/multi-tenant mode, but note this is a horizontal cross-tenant authorization flaw (CWE-639) requiring valid tenant credentials rather than a pre-auth internet-wide threat. SSVC-style read: exploitation=none observed, automatable=yes (simple API calls with substituted identifiers), technical impact=total within the certs service scope. |
| Exploit ScenarioDerived | An attacker signs up for or already holds a legitimate low-privilege account in one Magistrala workspace/tenant. Using their own authenticated workspace path, they call certs endpoints (ViewCert, ListCerts, IssueCert, RevokeBySerial, RevokeAll) while substituting another tenant's device IDs or certificate serials, because the service fails to scope these operations to the caller's workspace. The result is cross-tenant disclosure of certificates, mass revocation that disconnects victim devices, and issuance of CA-signed certificates for the victim's device IDs; no public exploit tool is referenced, but a step-by-step technical write-up is published. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 16, 2026
Cross-tenant authorization bypass in Magistrala through 1.0.0 allows any authenticated member of a workspace to view, issue, and revoke device certificates belonging to other tenants by supplying foreign serial numbers or entity/device IDs to the certs service (RevokeBySerial, RevokeAll, ViewCert, ListCerts, IssueCert). A successful attacker can disconnect other tenants' devices, disclose their certificates, and mint CA-signed certificates for arbitrary device IDs, giving high integrity and availability impact with limited confidentiality exposure (assessed CVSS:3.1 base 7.2, AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H). Exploitation is not pre-authentication, and no public exploit was identified at time of analysis; the practical risk is greatest on multi-tenant deployments that actively use the certificate service.
RemediationAI
No vendor-released patch or fixed version is identified in the available data for CVE-2026-111684, so the primary action is to track the upstream project at https://github.com/absmach/magistrala (and the VulnCheck advisory at https://www.vulncheck.com/advisories/magistrala-through-1.0.0-cross-tenant-authorization-bypass-in-certs-service) and upgrade as soon as a release that enforces workspace scoping on the certs service is published. Until then, apply targeted compensating controls: if the certificate service is not required, disable certificate issuance/revocation endpoints entirely (side effect: devices relying on Magistrala-issued certs must be migrated to an external PKI, and cert lifecycle operations must be handled manually). If the service is required, restrict it to a single trusted tenant/workspace or isolate each tenant on its own Magistrala instance/namespace, since the core defect is the absence of cross-tenant key validation (side effect: increased operational overhead and reduced multi-tenancy). Where possible, front the certs API with an authorization proxy or gateway that independently verifies that supplied serials and entity/device IDs belong to the caller's workspace before forwarding requests, and alert on any call referencing identifiers outside the caller's tenant. Treat tenant credentials as high-value, rotate them if cross-tenant enumeration is suspected, and monitor for anomalous RevokeAll/IssueCert activity that would indicate abuse. These are temporary mitigations with their own trade-offs and do not eliminate the underlying CWE-639 gap.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a classic CWE-639 authorization-bypass-through-user-controlled-key (IDOR-class) defect in Magistrala's certs service. The referenced source (certs/service.go, lines 136-180, and certs/middleware/authorization.go, lines 97-110) shows that certificate operations accept caller-supplied serials and entity/device IDs but do not scope those identifiers to the requesting workspace, so the tenant path in the request is effectively cosmetic. Because certificate issuance and revocation drive device identity and connection trust in an IoT/messaging platform, an attacker who can name a foreign ID can act across tenant boundaries: revoking a valid certificate disconnects a peer tenant's device, listing/viewing discloses certificate material, and issuance produces a CA-signed certificate for a device ID the attacker does not own. The affected product is identified by the CPE cpe:2.3:a:absmach:magistrala:*:*:*:*:*:*:*:*, covering releases up to and including 1.0.0. This is an authorization design gap rather than a memory-safety or cryptographic-primitive break.
Know when Magistrala gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N
Network API reachable (AV:N), simple identifier substitution (AC:L), requires any authenticated tenant member (PR:L), no interaction (UI:N); cert minting/revocation gives high integrity/availability, partial disclosure gives low confidentiality.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
DescriptionCVE.org
Magistrala through 1.0.0 contains an authorization bypass vulnerability that allows authenticated workspace members to view, issue, and revoke other tenants' device certificates by supplying foreign serials or entity ids. Attackers can call RevokeBySerial, RevokeAll, ViewCert, ListCerts, or IssueCert under their own workspace path to disconnect other tenants' devices, disclose certificates, and mint CA-signed certificates for their device ids.
Executive ViewAI
Magistrala through 1.0.0 contains a cross-tenant authorization bypass in its certificate service that allows any authenticated workspace member to view, issue, or revoke certificates for other tenants' devices. This can let an attacker disconnect other tenants' devices, expose their certificates, and mint CA-signed certificates for arbitrary device IDs, creating high integrity and availability risk for multi-tenant deployments that rely on the certificate service. Leadership should prioritize this because it breaks tenant isolation and can disrupt customer operations, though no public exploit identified at time of analysis.
No vendor-released patch identified at time of analysis. Interim mitigations include restricting access to the certs service to trusted administrative users, enforcing tenant-bound authorization at an API gateway or proxy for certificate operations, monitoring and alerting on certificate operations that reference foreign serial or entity/device IDs, and disabling certificate issuance/revocation where not operationally required.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Magistrala
View allAuthenticated SQL injection in the timescale-reader and postgres-reader HTTP APIs of Magistrala before 1.0.0 lets any us
SQL injection in Magistrala's message-readers API exposes PostgreSQL and TimescaleDB backends to arbitrary query manipul
Exploit-DB