Monitor vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.8
CVE-2026-71262: IoTSharp BlobStorageController lacks authentication, allowing unauthorized access
CVE-2026-71262 · published 1 month ago
Summary
The IoTSharp BlobStorageController is not secure because it doesn't require authentication, making it accessible to anyone. This can lead to unauthorized access to and manipulation of files, potentially allowing attackers to execute code on the server. To fix this, add the [Authorize] attribute to the controller and configure global authorization in the Startup.cs file.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| iotsharp | iotsharp | <= * |
Original advisory text
IoTSharp BlobStorageController Missing Authentication and Path Traversal
IoTSharp BlobStorageController.cs lacks the [Authorize] attribute applied to every other controller in the application (DevicesController, CustomersController, TenantsController, etc.), and no global authorization FallbackPolicy is configured in Startup.cs, leaving its Upload/Download/List/Modify/Delete endpoints reachable by unauthenticated remote attackers.
Severity
9.8
Critical
CVSS 3.1: 9.8 (NVD)
Exploitation
EPSS <1%
Type
CWE-306Missing Authentication for Critical Function
Timeline
Published5 Aug 2026
Updated30 Aug 2026
First seen5 Aug 2026
Monitor software like this
Free during beta