CVE-2026-71262CWE-306

CVE-2026-71262

Critical · published August 5, 2026

CVSS v3.1

9.8

EPSS

Percentile

49.5

In the wild

Unconfirmed

What it is

IoTSharp BlobStorageController.cs lacks the [Authorize] attribute applied to every other controller in the application (DevicesController, CustomersController, TenantsController, etc.), and no global authorization FallbackPolicy is configured in Startup.cs, leaving its Upload/Download/List/Modify/Delete endpoints reachable by unauthenticated remote attackers.

The record

Technical detail

CVSS v3.1: 9.8 · CRITICAL
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0: Not supplied
EPSS: 0.00630 · 49.5th percentile
Weakness: CWE-306 · Missing Authentication for Critical Function
Published: 2026-08-05T17:24Z

References (2)

https://github.com/IoTSharp/IoTSharp · 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c https://github.com/IoTSharp/IoTSharp/blob/master/IoTSharp/Controllers/BlobStorageController.cs · 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c

EPSS history

Timeline

05 AUG 12:26Z
IoTSharp BlobStorageController Missing Authentication and Path Traversal
cvelistv5