CVE-2026-73616
MediumCVSS 6.5Summary
OpenRemote notification deletion endpoints fail to enforce realm boundaries, allowing any realm administrator to delete notifications belonging to other realms. Attackers with write:admin role in one realm can send DELETE requests to remove notifications from the master realm or other tenants without authorization checks.
Risk Assessment
An administrator of one realm can disrupt operations of other tenants by deleting their notifications, potentially leading to loss of important information and data integrity issues.
Recommendation
It is recommended to apply vendor patches that enforce realm boundaries in notification deletion endpoints, and restrict access to these functions.
Original NVD description (English source)
OpenRemote notification deletion endpoints fail to enforce realm boundaries, allowing any realm administrator to delete notifications belonging to other realms. Attackers with write:admin role in one realm can send DELETE requests to remove notifications from the master realm or other tenants without authorization checks.