CVE-2026-82452CWE-306

CVE-2026-82452

Critical · published August 29, 2026

CVSS v3.1
9.8
EPSS
1%
Percentile
57.0
In the wild
Unconfirmed
What it is

rust-iot-platform through commit 5df942ab contains an authentication bypass vulnerability where most REST API routes lack authentication guards in their handler signatures. Unauthenticated attackers can create, update, list, retrieve, and delete user accounts by directly accessing unprotected endpoints without providing valid credentials.

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
9.3 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00826 · 57.0th percentile
Weakness
CWE-306 · Missing Authentication for Critical Function
Published
2026-08-29T18:16Z
References (3)
https://github.com/iot-ecology/rust-iot-platform · [email protected]https://github.com/iot-ecology/rust-iot-platform/blob/5df942ab6bc46a3bf83dbee8c7970554f92c972d/api/src/controller/user_router.rs · [email protected]https://www.vulncheck.com/advisories/rust-iot-platform-authentication-bypass-via-missing-request-guards · [email protected]
EPSS history
Timeline
  • 30 AUG 16:19Z
    EPSS moved — → 0%
    epss
  • 29 AUG 13:47Z
    rust-iot-platform Authentication Bypass via Missing Request Guards
    cvelistv5