CVE-2026-71262
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk46th percentile - higher than 46% of all known CVEs
Summary
In IoTSharp, BlobStorageController.cs lacks the [Authorize] attribute applied to every other controller, and no global authorization FallbackPolicy is configured in Startup.cs, leaving its Upload/Download/List/Modify/Delete endpoints reachable by unauthenticated remote attackers.
Risk Assessment
Risk of unauthorized access to stored files and their modification, potentially leading to confidentiality and integrity breaches and possible system compromise.
Recommendation
Add the [Authorize] attribute to BlobStorageController or configure a global authorization policy in Startup.cs. Additionally, test all endpoints for required authentication.
Original NVD description (English source)
IoTSharp BlobStorageController.cs lacks the [Authorize] attribute applied to every other controller in the application (DevicesController, CustomersController, TenantsController, etc.), and no global authorization FallbackPolicy is configured in Startup.cs, leaving its Upload/Download/List/Modify/Delete endpoints reachable by unauthenticated remote attackers.