High severity · published Oct 16, 2026
CVE-2026-111684
Magistrala through 1.0.0 Cross-Tenant Authorization Bypass in Certs Service
8.3
CVSS
0.2%
EPSS
No
On KEV
Description
Magistrala through 1.0.0 contains an authorization bypass vulnerability that allows authenticated workspace members to view, issue, and revoke other tenants' device certificates by supplying foreign serials or entity ids. Attackers can call RevokeBySerial, RevokeAll, ViewCert, ListCerts, or IssueCert under their own workspace path to disconnect other tenants' devices, disclose certificates, and mint CA-signed certificates for their device ids.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 13% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MA
magistrala · absmach
through 1.0.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-111684
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-111684
github.com
https://github.com/absmach/magistrala
github.com
https://github.com/absmach/magistrala/blob/v1.0.0/certs/middleware/authorization.go#L97-L110
github.com
https://github.com/absmach/magistrala/blob/v1.0.0/certs/service.go#L136-L180
hackmd.io
https://hackmd.io/@hieuPenguinnn/magistrala-certs-missing-workspace-scope-cross-tenant
www.vulncheck.com
https://www.vulncheck.com/advisories/magistrala-through-1.0.0-cross-tenant-authorization-bypass-in-certs-service
More from magistrala
8.8
CVE-2026-82028
Magistrala < 1.0.0 SQL Injection via format Parameter in Reader API
8.8
CVE-2026-71235
Magistrala IoT Platform - Unrestricted Go/Lua Script Execution in Rules Engine
7.1
CVE-2026-71276
Magistrala (formerly Mainflux) IoT Platform SQL Injection via format Query Parameter