CVE-2026-82452
CriticalCVSS 9.8Summary
rust-iot-platform through commit 5df942ab contains an authentication bypass vulnerability where most REST API routes lack authentication guards in their handler signatures. Unauthenticated attackers can create, update, list, retrieve, and delete user accounts by directly accessing unprotected endpoints without providing valid credentials.
Risk Assessment
Lack of authentication on key API routes allows unauthorized individuals to manage user accounts, potentially leading to data confidentiality breaches and system integrity compromise.
Recommendation
Update rust-iot-platform to a version containing the fix. Additionally, implement authentication on all API routes and regularly audit access.
Original NVD description (English source)
rust-iot-platform through commit 5df942ab contains an authentication bypass vulnerability where most REST API routes lack authentication guards in their handler signatures. Unauthenticated attackers can create, update, list, retrieve, and delete user accounts by directly accessing unprotected endpoints without providing valid credentials.