Skip to main content

OpenRemote CVE-2026-73616

| EUVDEUVD-2026-57820 HIGH
Authorization Bypass Through User-Controlled Key (CWE-639)
2026-08-13 VulnCheck GHSA-57pg-9v73-27m7
Authentication Bypass Openremote
7.1
CVSS 4.0 · Vendor: VulnCheck
Share

Severity by source

Vendor (VulnCheck) PRIMARY
7.1 HIGH
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
7.7 HIGH

Requires write:admin in any realm (PR:L); scope changes because other tenants' realm data is affected; high integrity impact with no confidentiality or availability loss.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N
4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
X

Lifecycle Timeline

2
Analysis Generated
Aug 13, 2026 - 12:44 vuln.today
CVE Published
Aug 13, 2026 - 11:28 cve.org
HIGH 7.1

DescriptionCVE.org

OpenRemote notification deletion endpoints fail to enforce realm boundaries, allowing any realm administrator to delete notifications belonging to other realms. Attackers with write:admin role in one realm can send DELETE requests to remove notifications from the master realm or other tenants without authorization checks.

AnalysisAI

Cross-realm authorization bypass in OpenRemote allows any authenticated realm administrator to permanently delete notifications belonging to other tenants, including the master realm. Any account holding the write:admin role in a single realm can issue DELETE requests targeting notification resource identifiers owned by foreign realms, because the deletion endpoint performs no cross-realm ownership check. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Obtain or compromise write:admin credentials in any realm
Delivery
Enumerate notification IDs belonging to master or peer realms
Exploit
Craft DELETE request targeting foreign realm's notification ID
Execution
API endpoint omits realm ownership validation
Impact
Notification permanently deleted from victim realm
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires a valid account with the write:admin role in at least one realm of the target OpenRemote instance - this is the critical and non-trivial prerequisite; unauthenticated users and users without any admin role cannot exploit this vulnerability. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) scores 7.1, reflecting a network-accessible, low-complexity attack requiring only the write:admin role in any realm. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker who controls or compromises an account with write:admin in any low-trust or newly provisioned realm enumerates or guesses notification IDs belonging to the master realm through iterative DELETE requests. Because the API endpoint performs no realm-boundary check on the supplied notification identifier, each valid ID is deleted silently and irrecoverably. …
Remediation Consult the GitHub Security Advisory GHSA-rc23-4mmm-4fx9 at https://github.com/openremote/openremote/security/advisories/GHSA-rc23-4mmm-4fx9 for the vendor-released patch and confirmed fixed version, as the available CPE data covers all versions without specifying a patched release that can be independently verified. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours, identify all multi-tenant OpenRemote deployments and document their tenant isolation criticality; audit IAM configurations to determine which accounts hold write:admin role. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Openremote

View all
CVE-2022-31860 CRITICAL POC
9.8 Sep 06

An issue was discovered in OpenRemote through 1.0.4 allows attackers to execute arbitrary code via a crafted Groovy rule
CVE-2026-66013 CRITICAL
9.3 Jul 25

Unauthorized modification of push notification tokens in OpenRemote before 1.26.2 allows unauthenticated attackers to re
CVE-2026-56784 HIGH
8.6 Jun 23

Cross-tenant alarm destruction in OpenRemote Manager before 1.24.2 lets any authenticated user in one realm permanently

CVE-2026-81679 HIGH
8.3 Aug 27

Cross-realm information disclosure in OpenRemote's Notification REST API exposes all tenants' notification history - inc
CVE-2026-62238 HIGH
7.2 Jul 17

SQL injection in OpenRemote's datapoint crosstab export endpoint (all versions before 1.26.0) lets an authenticated user
CVE-2026-65009 MEDIUM
5.3 Jul 21

Cross-tenant information disclosure in OpenRemote versions before 1.26.2 allows any authenticated user holding the read:
CVE-2026-67310 MEDIUM
5.3 Aug 01

Cross-tenant insecure direct object reference in OpenRemote versions up to and including 1.26.2 allows an authenticated

Same weakness CWE-639 – Authorization Bypass Through User-Controlled Key

View all
CVE-2024-50483 CRITICAL
9.8
CVE-2026-55255 HIGH POC
8.4
CVE-2025-3605 CRITICAL POC
9.8
CVE-2022-3805 HIGH POC
8.6
CVE-2025-5947 CRITICAL POC
9.8
CVE-2020-36923 CRITICAL POC
9.8
CVE-2025-14998 CRITICAL POC
9.8
CVE-2023-3048 CRITICAL POC
9.8

Same technique Authentication Bypass

View all
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2022-40684 CRITICAL POC
9.8
CVE-2025-61882 CRITICAL POC
9.8
CVE-2024-0012 CRITICAL POC
9.3
CVE-2023-46805 HIGH POC
8.2

Share

CVE-2026-73616 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy