EUVD-2026-38594
GHSA-vjr9-f93j-mjr7
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable API exploitable by any low-privileged authenticated user with alarm-write role; cross-tenant deletion changes scope (S:C); integrity and availability of other realms' alarms are high, no confidentiality impact.
Primary rating from Vendor (vulncheck).
CVSS VectorVendor: vulncheck
Lifecycle Timeline
3DescriptionCVE.org
OpenRemote before 1.25.0 contains an insecure direct object reference (IDOR) vulnerability in the bulk alarm deletion endpoint that allows authenticated users to permanently delete alarms belonging to other tenants by supplying arbitrary alarm IDs. The removeAlarms() method in AlarmResourceImpl.java omits realm-scoping validation in its JPA query, enabling any user with alarm-write permissions to enumerate sequential auto-increment alarm IDs and delete cross-tenant alarm records without authorization.
Articles & Coverage 1
AnalysisAI
Cross-tenant alarm destruction in OpenRemote Manager (versions before 1.25.0) allows any authenticated user with alarm-write permissions in their own realm to permanently delete alarm records belonging to other tenants by submitting arbitrary sequential alarm IDs to the bulk-delete endpoint. The flaw stems from missing per-record realm scoping in removeAlarms() and is rated CVSS 4.0 8.6 (high); no public exploit identified at time of analysis, but the GHSA advisory documents the exact vulnerable code path, making weaponization straightforward.
Technical ContextAI
OpenRemote is a Java-based open-source IoT platform; the affected component is the Manager service, which exposes a JAX-RS alarm management API backed by JPA/Hibernate against a SentAlarm entity. The bulk endpoint AlarmResourceImpl.removeAlarms() invokes isRealmActiveAndAccessible() only against the caller's own realm - a check any authenticated user satisfies - and then passes the user-supplied List<Long> directly to JPQL queries 'select sa from SentAlarm sa where sa.id in :ids' and 'delete from SentAlarm sa where sa.id in :ids', neither of which filters on realm. This is a textbook CWE-639 (Authorization Bypass Through User-Controlled Key), compounded by the fact that SentAlarm primary keys are JPA @GeneratedValue sequential Longs, so an attacker does not need to discover IDs out-of-band - they can simply enumerate. Notably the singular removeAlarm() does perform the per-record realm check, indicating the bug is a localized omission in the plural path rather than a systemic authorization-model failure.
RemediationAI
Upgrade OpenRemote Manager to the vendor-released patched version - per the 1.25.0 release notes the fix is included in 1.25.0, though the GHSA advisory references 1.24.2 as fixed, so confirm the appropriate target with the vendor and apply the highest available release. The fix should be obtained from https://github.com/openremote/openremote/releases/tag/1.25.0 and the advisory at https://github.com/openremote/openremote/security/advisories/GHSA-h3m5-97jq-qjrf. If immediate patching is not possible, compensating controls include revoking the alarm-write role from all non-administrative users (which disables legitimate alarm management for those users), placing a reverse proxy or API gateway rule that blocks or audits DELETE/POST requests to the bulk alarm deletion endpoint (which will break legitimate bulk-delete UX), or, for multi-tenant operators, temporarily collapsing to single-tenant deployments per customer to eliminate cross-realm impact (high operational cost). Enable database-level audit logging on the SentAlarm table to detect mass deletions while the patch is rolled out.
Oracle Java SE 7 Update 6 and earlier contains multiple sandbox bypass vulnerabilities via the ClassFinder and forName m
Remote code execution in IBM Sterling B2B Integrator, Sterling Integrator, and Tivoli Common Reporting allows unauthenti
Java Runtime Environment sandbox bypass via incorrect image channel verification in 2D component allows remote unauthent
Oracle Java SE JDK/JRE 7 and 6 Update 27 and earlier allows remote code execution with complete system compromise throug
JBoss Seam 2 in Red Hat JBoss EAP 4.3.0 fails to sanitize JBoss Expression Language inputs, allowing remote attackers to
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 update 4 and earlier, 6 up
Multiple vulnerabilities in Oracle Java 7 before Update 11 allow remote attackers to execute arbitrary code by (1) using
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 2 and earlier, 6 Up
The WLS Security component in Oracle WebLogic Server 10.3.6.0, 12.1.2.0, 12.1.3.0, and 12.2.1.0 allows remote attackers
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier allow
Remote unauthenticated attackers can execute arbitrary code on Adobe ColdFusion servers through Java deserialization fla
The ExceptionDelegator component in Apache Struts before 2.2.3.1 interprets parameter values as OGNL expressions during
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today