CVE-2026-111629

IoTSharp versions through 3.6.1 are vulnerable to an Insecure Direct Object Reference (IDOR) vulnerability in the Customers and Devices API handlers. The root cause is a failure to scope database queries to the caller's specific tenant, allowing any authenticated user to access data from other te...