The vulnerability is an insecure direct object reference that lets any authenticated user read data belonging to other tenants. Attackers can self-register via the anonymous AccountController.Create endpoint, supply another tenant's GUID, and use the Customers or Devices API to retrieve customer contact details, device inventories, and device attribute telemetry. The result is a confidentiality breach of tenant data. The weakness is classified as CWE‑639 (Missing Authorization).

The affected product is IoTSharp, running version 3.6.1 and earlier. This software provides IoT device management services with a tenant isolation model that is compromised by the flaw.

The CVSS score of 5.3 classifies the vulnerability as medium. EPSS data is not available, and the issue is not listed in the CISA KEV catalog. An attacker only needs to be authenticated, and registration is trivial through the public AccountController.Create endpoint, so the likelihood of exploitation is high. Exploitation provides full read access to any tenant's customer and device data. No public exploit has been disclosed, but the clear attack path makes the threat realistic.