CVE-2026-111684

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-111684
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-111684.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-111684
Published
2026-10-16T17:39:41Z
Modified
2026-10-24T02:49:52Z
Severity
  • 7.2 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
Magistrala through 1.0.0 Cross-Tenant Authorization Bypass in Certs Service
Details

Magistrala through 1.0.0 contains an authorization bypass vulnerability that allows authenticated workspace members to view, issue, and revoke other tenants' device certificates by supplying foreign serials or entity ids. Attackers can call RevokeBySerial, RevokeAll, ViewCert, ListCerts, or IssueCert under their own workspace path to disconnect other tenants' devices, disclose certificates, and mint CA-signed certificates for their device ids.

Database specific 
{
    "cna_assigner":  "VulnCheck",
    "cwe_ids":  [
        "CWE-639"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/111xxx/CVE-2026-111684.json"
}
References

Affected packages

Git / github.com/absmach/magistrala

Affected ranges

Type
GIT
Repo
https://github.com/absmach/magistrala
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last Affected
c446d629455c321a6b4d9e39981a0158659f3da8
Database specific
Show details 
{
    "extracted_events":  [
        {
            "range":  [
                {
                    "introduced":  "0"
                },
                {
                    "last_affected":  "1.0.0"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandardRange"
        },
        {
            "range":  [
                {
                    "introduced":  "0"
                },
                {
                    "last_affected":  "1.0.0"
                }
            ],
            "source":  "DESCRIPTION"
        }
    ]
}

Affected versions

0.*
0.1.0
0.1.1
0.1.2
0.10.0
0.11.0
0.12.0
0.12.1
0.13.0
0.2.0
0.2.1
0.2.2
0.2.3
0.3.0
0.4.0
0.5.0
0.5.1
0.6.0
0.6.1
0.7.0
0.8.0
0.9.0
v0.*
v0.11.0
v0.14.0
v0.15.0
v0.15.1
v0.16.0
v0.17.0
v0.17.0-rc.1
v0.17.0-rc.2
v0.18.0
v0.18.1
v0.18.2
v0.18.3
v0.18.4
v0.18.5
v0.19.0
v0.19.1
v0.20.0
v0.30.0
v0.40.0
v0.50.0
v0.51.0
v1.*
v1.0.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-111684.json"