CVE-2026-67310

OpenRemote is an open-source internet-of-things platform. Prior to 1.24.2, the get, getUserClientRoles, and getUserRealmRoles methods authorize callers with the read:admin role without confirming that the target UUID belongs to the requested and authenticated realm. A realm administrator can retrieve user data from another tenant or the master realm, breaking tenant isolation.

OpenRemote is an open-source internet-of-things platform. Prior to 1.24.2, the KNXProtocol.startAssetImport method processes 0.xml from an uploaded ETS project ZIP with XML parsers that permit external entity resolution, allowing file reads accessible to the JVM process or server-side requests.

OpenRemote before 1.26.2 contains an authentication bypass vulnerability in the console registration API that allows unauthenticated attackers to update existing console assets by supplying a known asset identifier.

OpenRemote prior to version 1.24.1 allows users with only read:assets privileges to write predicted datapoints via the predicted datapoint write endpoint. Version 1.24.1 fixes the issue.

OpenRemote before version 1.28.0 contains a cross-realm information disclosure vulnerability in the Notification REST API. Tenant administrators can read all tenants' sent notifications including message bodies by submitting a zero-parameter GET request to the notification endpoint.

OpenRemote notification deletion endpoints fail to enforce realm boundaries, allowing any realm administrator to delete notifications belonging to other realms. Attackers with write:admin role in one realm can send DELETE requests to remove notifications from the master realm or other tenants without authorization checks.

Vulnerability in OpenRemote before version 1.26.2. The SyslogResource REST endpoint (`GET /api/{realm}/syslog/event`) fails to filter operational logs by realm, allowing attackers with `read:rules` role to read logs from all tenants, including asset IDs, agent connection details, rule names, and protocol errors.

OpenRemote before version 1.26.0 contains an authenticated SQL injection vulnerability in the datapoint crosstab export endpoint. The vulnerability is caused by concatenating asset display names directly into PostgreSQL queries, allowing an attacker with asset creation or rename permissions to inject malicious SQL.

An IDOR vulnerability in OpenRemote before 1.25.0 allows authenticated users to permanently delete alarms belonging to other tenants by supplying arbitrary alarm IDs. The removeAlarms() method in AlarmResourceImpl.java omits realm-scoping validation in its JPA query.