The vulnerability in Magistrala’s Certs service allows an authenticated user belonging to one tenant to perform certificate actions—viewing, revoking, and issuing—on devices belonging to other tenants by supplying foreign serial numbers or entity identifiers. This bypasses normal tenant isolation and can lead to unintended device disconnection, disclosure of cryptographic material, and creation of CA‑signed certificates for the attacker’s device IDs.

Vendor: absmach; Product: Magistrala, Version 1.0.0 and earlier. All releases up to and including 1.0.0 are affected.

The CVSS score of 7.2 indicates high severity, but the EPSS score is not available, making the exact exploitation likelihood unclear. The vulnerability is not listed in CISA’s KEV catalog. Attackers must first authenticate with a workspace account and then invoke the Certs endpoints, so the vector is Authenticated Remote. Given the moderate to high potential impact on confidentiality and integrity, the risk is considered significant for installations that have not yet been patched.