CVE-2026-111629 IoTSharp through 3.6.1 Cross-Tenant Data Exposure via Customers and Devices APIs allows any authenticated user to read other tenants' data due to insecure direct object reference vulnerability. IoTSharp users and administrators should assess exposure and prioritize remediation efforts immediately. The vulnerability affects IoTSharp versions up to 3.6.1 and involves improper scoping of quer [truncated]
The IoTSharp application has a critical vulnerability in its BlobStorageController.cs, which lacks the [Authorize] attribute, making its endpoints accessible to unauthenticated remote attackers. This vulnerability, combined with unsanitized path and filename parameters, allows for path traversal and potential remote code execution via webshell upload. The affected product is IoTSharp, and the vulnerabilit [truncated]
