ShellHub's API endpoint GET /api/devices/:uid returns the full device object whenever a caller is authenticated, but it does not verify that the requested device actually belongs to the caller's namespace. As a result, any authenticated user who knows or can guess a device UID can read device metadata from any other namespace. This user‑controlled disclosure (CWE‑639) allows attackers to obtain sensitive information about devices they should not be able to see. The impact is a breach of confidentiality that can expose operational details and potentially aid further attacks against those devices.

ShellHub by shellhub‑io, versions prior to 0.24.2. The issue exists in all builds before the 0.24.2 release and is fixed in that version and later releases.

The CVSS score of 6.5 categorizes this vulnerability as moderate, and the EPSS score is not available, indicating no publicly known exploitation data yet. Since an attacker must be authenticated and must be able to guess or know a device UID, the likelihood of exploitation is limited to situations where an account has broad API access. This vulnerability is not currently listed in CISA's KEV catalog. Exploitation can be achieved by a legitimate user who, intentionally or not, requests a UID belonging to another tenant’s device, leading to cross‑tenant data disclosure.