CVE-2026-81679
HighCVSS 7.7Summary
OpenRemote before version 1.28.0 contains a cross-realm information disclosure vulnerability in the Notification REST API. Tenant administrators can read all tenants' sent notifications including message bodies by submitting a zero-parameter GET request to the notification endpoint.
Risk Assessment
Disclosure of notification content across tenants may compromise data confidentiality and allow unauthorized access to sensitive information.
Recommendation
Upgrade OpenRemote to version 1.28.0 or later, which fixes this vulnerability.
Original NVD description (English source)
OpenRemote versions before 1.28.0 contain a cross-realm information disclosure vulnerability in the Notification REST API that allows per-realm tenant administrators to read all tenants' sent notifications including message bodies. Attackers with read:admin credentials in one realm can submit a zero-parameter GET request to the notification endpoint to retrieve sensitive notification metadata and message content from all realms.