CVE-2026-82452
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk39th percentile - higher than 39% of all known CVEs
Summary
rust-iot-platform through commit 5df942ab contains an authentication bypass vulnerability where most REST API routes lack authentication guards in their handler signatures. Unauthenticated attackers can create, update, list, retrieve, and delete user accounts by directly accessing unprotected endpoints without providing valid credentials.
Risk Assessment
Lack of authentication on key API routes allows unauthorized individuals to manage user accounts, potentially leading to data confidentiality breaches and system integrity compromise.
Recommendation
Update rust-iot-platform to a version containing the fix. Additionally, implement authentication on all API routes and regularly audit access.
Other vulnerabilities in rust-iot-platform
See all- CVE-2026-71278Critical
rust-iot-platform allows creating a 'calc rule' via POST /calc-rule/create (api/src/controller/calc_rule_router.rs) containing an arbitrary field. This route does not take the AuthToken request guard used elsewhere in the application, making it reachable without authentication.
- CVE-2026-71277Critical
In rust-iot-platform, the AuthToken request-guard implementation (api/src/main.rs) only checks whether the Authorization HTTP header is present, and never validates its value against any session, token store, or signature. Any request carrying an arbitrary non-empty Authorization header (e.g. ) satisfies the guard, granting access to every endpoint protected only by this request guard.
- CVE-2026-82453High
rust-iot-platform through commit 5df942ab stores user passwords in cleartext without hashing in the user model. Attackers can read API responses from user retrieval and listing routes to obtain plaintext credentials for all accounts.
Original NVD description (English source)
rust-iot-platform through commit 5df942ab contains an authentication bypass vulnerability where most REST API routes lack authentication guards in their handler signatures. Unauthenticated attackers can create, update, list, retrieve, and delete user accounts by directly accessing unprotected endpoints without providing valid credentials.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS