CVE-2026-71262 — IoTSharp BlobStorageController Missing Authentication and Path Traversal
IoTSharp BlobStorageController.cs lacks the [Authorize] attribute applied to every other controller in the application (DevicesController, CustomersController, TenantsController…
Published: 2026-08-05 · CVSS: 9.8 · CVSS 3.1
IoTSharp BlobStorageController.cs lacks the [Authorize] attribute applied to every other controller in the application (DevicesController, CustomersController, TenantsController, etc.), and no global authorization FallbackPolicy is configured in Startup.cs, leaving its Upload/Download/List/Modify/Delete endpoints reachable by unauthenticated remote attackers.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7