Monitor vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.3

rust-iot-platform allows anyone to manage user accounts via its API

CVE-2026-82452 · published 5 days ago
Summary

The rust-iot-platform software lets anyone send requests to most of its web API functions without needing to log in. As a result, an unauthenticated person could create, change, view, or delete user accounts. Apply the latest update or add proper login checks to the API endpoints to stop this.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
iot-ecology rust-iot-platform <= 5df942ab6bc46a3bf83dbee8c7970554f92c972d
Original advisory text
rust-iot-platform through commit 5df942ab contains an authentication bypass vulnerability where most REST API routes lack authentication guards in their handler signatures. Unauthenticated attacker...
rust-iot-platform through commit 5df942ab contains an authentication bypass vulnerability where most REST API routes lack authentication guards in their handler signatures. Unauthenticated attackers can create, update, list, retrieve, and delete user accounts by directly accessing unprotected endpoints without providing valid credentials.
References
Severity
9.3 Critical
CVSS 3.1: 9.8 (MITRE)
Exploitation
EPSS <1%
Type
CWE-306Missing Authentication for Critical Function
Timeline
Published29 Aug 2026
Updated2 Sep 2026
First seen29 Aug 2026
Sources
CVE-2026-82452 · NVD
CVE-2026-82452 · MITRE
Monitor software like this
Free during beta