CVE-2026-111684 is a high severity (CVSS 8.3) authorization bypass in Magistrala through 1.0.0. An authenticated workspace member can view, issue and revoke other tenants' device certificates. The record names no fixed version, so limit membership and audit certificate activity. The sections below cover affected versions, how to check, and what to do first.
What's affected
Magistrala 1.0.0 and earlier, per the record and VulnCheck. The certificates service is the affected component. I could not confirm a fixed release from the pages I fetched, so check the project's releases and issue tracker before you rely on one.
The record lists the calls involved: RevokeBySerial, RevokeAll, ViewCert, ListCerts and IssueCert. They can be invoked under the caller's own workspace path while naming another tenant's serial numbers or entity IDs.
Scoring note: the record's 8.3 is a CVSS 3.1 base score. VulnCheck's advisory also lists 7.2 under CVSS 4.0. Both describe the same flaw, and the two versions weigh the factors differently.
How to check if you're exposed
Confirm the Magistrala version in your deployment. Review the certificate service's records for revocations you did not request, and for certificates issued for device IDs that belong to another workspace.
Check device connectivity too. The record says revoking other tenants' certificates disconnects their devices, so an unexplained drop in connected devices is a signal.
What to do now
- Identify your Magistrala deployments and versions.
- Restrict workspace membership to people you trust while no fix is confirmed.
- Audit the certificate service for cross workspace issuance and revocation.
- Reissue certificates for devices that were revoked without cause.
- Revoke and replace any certificate you cannot trace to its owner.
- Upgrade once a fixed release is published.
- Scan your dependencies with the free in-browser scan and look the CVE up in the Gold directory to see where else it appears.
Prioritise by what is reachable, not by the score alone. Reachability analysis asks whether your own code actually calls the vulnerable path and whether an attacker can get to it. A flaw in a component you never expose is less urgent than the same flaw on a public host, so use that view to order your work.
Why it matters
This is CWE-639, authorization bypass through a user-controlled key. The service accepts a serial number or entity ID and acts on it without checking that it belongs to the caller's workspace. The workspace in the URL path says who you are, but not which objects you may touch.
In an IoT platform, certificates are device identity. A forged certificate signed by the platform's CA can let someone impersonate a device, and mass revocation can take a fleet offline. It is not listed in CISA KEV.
Quick check
Why is issuing a certificate worse than reading one?
A CA-signed certificate for a device ID acts as that device's identity, so it can be used to impersonate it.
Does revoking help?
Revoking cleans up what you find, but the flaw remains until a patched build runs.
Sources
Last reviewed: 18 October 2026.
