Tata Fixes iRA App Security Issues After 2023 API Flaws

Tata’s response is central here. In October 2023, flaws in the iRA app exposed personal data and remote vehicle controls. Security researcher Saurabh Arora found vulnerabilities in the application programming interface (API), which Tata Motors later addressed. Tata Motors offers its iRA connected-car technology in models including the Nexon, Nexon EV, Harrier and Safari. A supplied Nexon EV price range is marked unconfirmed, not verified current pricing.

What Were the Tata Fixes iRA App Security Issues?

In October 2023, security researcher Saurabh Arora identified API flaws in Tata Motors’ iRA connected-car application. The weaknesses involved endpoint authorisation—the checks that decide whether an account or request can access specific information or functions.

The issues could expose personal data and remote vehicle controls, making them more serious than a routine app glitch. Several Tata vehicles use the affected technology, including the Nexon, Nexon EV, Harrier and Safari. That puts the security response in focus for owners across more than one model line. So how did Tata address the access-control problem?

How Did Tata Fix the iRA App Security Issues?

Tata Motors deployed server-side patches to fix the API endpoint authorization issues. The company made the changes on its servers, so owners didn’t need to take their vehicles to a dealership for a physical repair.

The response addressed the authorization layer, with no reported hardware replacement. That matters for connected-car systems, where digital services can link an owner’s account to vehicle functions. The available facts don’t say whether owners needed to take any additional app-side steps, so we can’t assume they had to reinstall or update the app. The remedy described was server-side. Its wider significance comes from the number of vehicles that use iRA.

Which Tata Models Use iRA, and Why Does That Matter?

The iRA suite features in four Tata models: the Nexon, Nexon EV, Harrier and Safari. That brings the security issue to owners of both passenger cars and electric vehicles. The concern goes beyond whether an app connects reliably: authorization controls matter when a service handles personal information and remote vehicle functions.

The situations differ, but both reflect a modern ownership reality: a vehicle’s experience depends on more than its physical components. That makes it useful to understand the status of a digital fix, even without a dealership visit. The supplied Nexon EV price range of ₹14.49 lakh to ₹19.49 lakh ex-showroom is explicitly marked unconfirmed, so don’t treat it as verified pricing for November 2026. Some Nexon EV range and performance figures are also marked unconfirmed in the supplied facts; they aren’t needed to assess the security response. What matters is what owners can confirm about the patch and their accounts. For more detail, see Roadshow by CNET.

What Should iRA Owners Watch for Next?

Tata’s server-side remedy meant the reported fix didn’t require a dealership appointment. Owners can check official Tata Motors communications for guidance on account access or app use, rather than assume they need to take extra steps. The supplied facts don’t confirm a separate customer notification process or a security update that users must install.

The main follow-up is whether Tata shares clear information about the fix’s scope and any action owners should take. That would help customers tell a server-side correction apart from steps they may need to complete themselves. For now, the confirmed point is that Tata addressed the API authorization issues without a physical service visit. Bottom line: Tata fixed iRA app security issues through server-side patches, avoiding a dealership visit; owners should check official guidance for any further account-related steps.

Read Next

• BYD Denza Z9 GT Spied in india: 952 hp and 630 km Claims
• Next Gen Kia Sonet New LED Design Spied During High-Altitude Testing
• Toyota Tundra Owner Dodges a $25,000 Repair Bill: What Is Known

FAQs