Authorization Bypass in Magistrala Affects Device Certificate Management

CVE-2026-111684

What is CVE-2026-111684?

Magistrala version 1.0.0 has a serious vulnerability that enables authenticated workspace users to bypass authorization controls. This flaw permits users to access and manipulate device certificates from other tenants by providing unauthorized serial numbers or entity IDs. An attacker can exploit this vulnerability using functions like RevokeBySerial, RevokeAll, ViewCert, ListCerts, or IssueCert to manage devices outside their own workspace. This could lead to unauthorized disconnection of devices, disclosure of sensitive certificates, and unauthorized issuance of certificates, jeopardizing the integrity of the application's certificate management system.

References