CVE-2026-111629Published
IoTSharp through 3.6.1 Cross-Tenant Data Exposure via Customers and Devices APIs
Explicit identifiers and source references
These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.
CVE-2026-111629 · Microsoft / collected KEV context
cve-program · CVE-2026-111629
- https://hackmd.io/@hieuPenguinnn/iotsharp-devices-customers-cross-tenant-idor
- https://github.com/IoTSharp/IoTSharp/blob/v3.6.1/IoTSharp/Controllers/CustomersController.cs#L164-L177
- https://github.com/IoTSharp/IoTSharp/blob/v3.6.1/IoTSharp/Controllers/DevicesController.cs#L490-L507
- https://www.vulncheck.com/advisories/iotsharp-through-3.6.1-cross-tenant-data-exposure-via-customers-and-devices-apis
Related operational evidence
Explicit CVE identifiersNo related operational record is retained in the current change model.