EUVD-2026-51838
GHSA-4f8w-fmh5-hcxr
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Scope changes because exploitation crosses tenant authorization boundaries to affect victim realm data; PR:L reflects required low-privilege authentication; no availability impact observed.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
2DescriptionCVE.org
OpenRemote (org.openremote:openremote) versions <= 1.26.2 contain an insecure direct object reference vulnerability in the setAssetLinks endpoint of AlarmResourceImpl. The realm access check validates only a single realm obtained via realms.stream().findFirst() on a HashSet of realms from the request, rather than all realms. Because HashSet iteration order is non-deterministic, an authenticated attacker who includes alarm-asset links from both their own realm and a victim realm can, with roughly 50% probability per request (retryable), persist cross-tenant links and disclose victim asset names (returned via @Formula fields) through GET requests on the attacker's own alarm. Fixed in 1.27.0.
AnalysisAI
Cross-tenant insecure direct object reference in OpenRemote versions up to and including 1.26.2 allows an authenticated attacker to bypass realm access controls in the AlarmResourceImpl.setAssetLinks endpoint, disclosing victim tenant asset names and persisting unauthorized cross-realm alarm-asset links. The flaw stems from a structurally incomplete authorization check that validates only the first realm returned by non-deterministic HashSet iteration rather than all realms submitted in the request, making the attack probabilistically repeatable until successful. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The attacker must hold a valid authenticated account (low privilege - any registered user) in a multi-tenant OpenRemote deployment with at least two realms configured; single-realm deployments are not vulnerable to cross-tenant impact. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N) yields a score of 5.3, consistent with a medium-severity finding bounded by the authentication requirement (PR:L) and limited impact scope. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An authenticated attacker with a valid low-privilege account on a multi-tenant OpenRemote deployment crafts a setAssetLinks request that interleaves alarm-asset link entries from their own realm with entries referencing a victim tenant's assets, then submits the request repeatedly - on average twice - until non-deterministic HashSet ordering causes the authorization check to evaluate the attacker's realm first and pass. Once the cross-tenant link is persisted in the database, the attacker issues a standard GET request on their own alarm object and reads victim asset names exposed via Hibernate @Formula annotations in the response. … |
| Remediation | Upgrade to OpenRemote version 1.27.0 or later, which corrects the incomplete authorization logic in AlarmResourceImpl.setAssetLinks to validate all realms in the submitted set rather than only the first element returned by HashSet iteration. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Openremote
View allAn issue was discovered in OpenRemote through 1.0.4 allows attackers to execute arbitrary code via a crafted Groovy rule
Unauthorized modification of push notification tokens in OpenRemote before 1.26.2 allows unauthenticated attackers to re
Cross-tenant alarm destruction in OpenRemote Manager before 1.24.2 lets any authenticated user in one realm permanently
Cross-realm information disclosure in OpenRemote's Notification REST API exposes all tenants' notification history - inc
SQL injection in OpenRemote's datapoint crosstab export endpoint (all versions before 1.26.0) lets an authenticated user
Cross-realm authorization bypass in OpenRemote allows any authenticated realm administrator to permanently delete notifi
Cross-tenant information disclosure in OpenRemote versions before 1.26.2 allows any authenticated user holding the read:
Same weakness CWE-863 – Incorrect Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today