CVE-2026-67310
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk8th percentile - higher than 8% of all known CVEs
Summary
OpenRemote (org.openremote:openremote) versions up to 1.26.2 contain an insecure direct object reference (IDOR) vulnerability in the setAssetLinks endpoint of AlarmResourceImpl. The realm access check validates only a single realm obtained via realms.stream().findFirst() on a HashSet of realms from the request, rather than all realms. Due to non-deterministic HashSet iteration order, an authenticated attacker can, with roughly 50% probability per request (retryable), persist cross-tenant links and disclose victim asset names.
Risk Assessment
An attacker can access victim asset names in another realm, breaking multi-tenant isolation and potentially leading to sensitive information disclosure.
Recommendation
Update OpenRemote to version 1.27.0 or later, which includes the fix.
Other vulnerabilities in OpenRemote
See all- CVE-2026-73616Medium
OpenRemote notification deletion endpoints fail to enforce realm boundaries, allowing any realm administrator to delete notifications belonging to other realms. Attackers with write:admin role in one realm can send DELETE requests to remove notifications from the master realm or other tenants without authorization checks.
- CVE-2026-66013Critical
OpenRemote before 1.26.2 contains an authentication bypass vulnerability in the console registration API that allows unauthenticated attackers to update existing console assets by supplying a known asset identifier.
- CVE-2026-81679High
OpenRemote before version 1.28.0 contains a cross-realm information disclosure vulnerability in the Notification REST API. Tenant administrators can read all tenants' sent notifications including message bodies by submitting a zero-parameter GET request to the notification endpoint.
- CVE-2026-65009Medium
Vulnerability in OpenRemote before version 1.26.2. The SyslogResource REST endpoint (`GET /api/{realm}/syslog/event`) fails to filter operational logs by realm, allowing attackers with `read:rules` role to read logs from all tenants, including asset IDs, agent connection details, rule names, and protocol errors.
- CVE-2026-62238High
OpenRemote before version 1.26.0 contains an authenticated SQL injection vulnerability in the datapoint crosstab export endpoint. The vulnerability is caused by concatenating asset display names directly into PostgreSQL queries, allowing an attacker with asset creation or rename permissions to inject malicious SQL.
- CVE-2026-56784High
An IDOR vulnerability in OpenRemote before 1.25.0 allows authenticated users to permanently delete alarms belonging to other tenants by supplying arbitrary alarm IDs. The removeAlarms() method in AlarmResourceImpl.java omits realm-scoping validation in its JPA query.
Original NVD description (English source)
OpenRemote (org.openremote:openremote) versions <= 1.26.2 contain an insecure direct object reference vulnerability in the setAssetLinks endpoint of AlarmResourceImpl. The realm access check validates only a single realm obtained via realms.stream().findFirst() on a HashSet of realms from the request, rather than all realms. Because HashSet iteration order is non-deterministic, an authenticated attacker who includes alarm-asset links from both their own realm and a victim realm can, with roughly 50% probability per request (retryable), persist cross-tenant links and disclose victim asset names (returned via @Formula fields) through GET requests on the attacker's own alarm. Fixed in 1.27.0.