Authorization Bypass Vulnerability in Magistrala

Magistrala versions through 1.0.0 contain an authorization bypass vulnerability (CVE-2026-111684) that affects multi-tenant deployments. The vulnerability resides in the workspace certificate management logic, specifically failing to adequately validate the association between the authenticated user's workspace context and the requested device entity or serial number. An authenticated user belonging to one workspace can manipulate API requests to target resources belonging to other tenants. This flaw allows unauthorized actors to view, revoke, or issue certificates for devices they do not own or manage. Because Magistrala functions as an IoT message broker and platform, this vulnerability can lead to critical operational impact, including the mass disconnection of IoT devices, unauthorized disclosure of sensitive identity certificates, and the minting of rogue CA-signed certificates for arbitrary device IDs.

Impact

The vulnerability allows for cross-tenant unauthorized access, resulting in the potential compromise of IoT device integrity and communication privacy. Attackers can disconnect legitimate tenant devices, exfiltrate sensitive certificate data, and impersonate devices by minting unauthorized certificates. This is particularly critical for industrial or enterprise IoT deployments where device identity is the foundation of trust.

Recommendation

1. Patch Magistrala immediately to a version that addresses CVE-2026-111684 once the vendor provides the update.
2. Audit API access logs for unauthorized attempts to invoke certificate management methods (RevokeBySerial, RevokeAll, ViewCert, ListCerts, IssueCert) across workspace boundaries.
3. Review current workspace membership permissions and implement strict least-privilege access control until a patch is applied.