Which versions of OpenRemote are affected by EUVD-2026-67035?

OpenRemote's Notification REST API contains a cross-realm information disclosure vulnerability (CVE-2026-81679, CVSS 8.3) allowing any authenticated tenant administrator to retrieve notification…. A patch is available.

How to fix or mitigate EUVD-2026-67035?

Within 24 hours, audit all tenant administrator accounts on OpenRemote deployments and immediately restrict Notification REST API access to only essential administrators; disable API privileges for non-critical admin accounts. Within 7 days, implement network-level firewall rules limiting access to Notification API endpoints, review audit logs for unauthorized API requests, and establish baseline monitoring of API usage patterns. Within 30 days, monitor OpenRemote vendor security advisories and patch release channels, develop a formal upgrade plan for deployment once a patch is available, and conduct a comprehensive audit of notification data access logs to identify any unauthorized cross-realm access.

OpenRemote EUVD-2026-67035

Q: What is the CVSS score of EUVD-2026-67035?

EUVD-2026-67035 has a CVSS 4.0 base score of 8.3 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X.

| CVE-2026-81679 HIGH

Information Exposure (CWE-200)

2026-08-27 VulnCheck

GHSA-fgj3-5frq-8vw8

Information Disclosure Openremote

8.3

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

8.3 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.7 HIGH

Network-accessible API, low privilege (tenant admin in any realm), changed scope because cross-realm exposure affects other tenants; no integrity or availability impact applies.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Aug 27, 2026 - 18:02 EUVD

Analysis Generated

Aug 27, 2026 - 17:46 vuln.today

CVE Published

Aug 27, 2026 - 14:50 cve.org

HIGH 8.3

DescriptionCVE.org

OpenRemote versions before 1.28.0 contain a cross-realm information disclosure vulnerability in the Notification REST API that allows per-realm tenant administrators to read all tenants' sent notifications including message bodies. Attackers with read:admin credentials in one realm can submit a zero-parameter GET request to the notification endpoint to retrieve sensitive notification metadata and message content from all realms.

AnalysisAI

Cross-realm information disclosure in OpenRemote's Notification REST API exposes all tenants' notification history - including full message bodies - to any authenticated tenant administrator on the platform. Any user holding read:admin credentials in one realm can issue a single zero-parameter GET request to retrieve sensitive notification data belonging to every other realm. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Obtain read:admin credentials in any realm

Exploit

Send zero-parameter GET to notification endpoint

Execution

API returns all realms' notification records

Impact

Extract message bodies and recipient metadata from co-tenant realms

Access

Obtain read:admin credentials in any realm

Exploit

Send zero-parameter GET to notification endpoint

Execution

API returns all realms' notification records

Impact

Extract message bodies and recipient metadata from co-tenant realms

Vulnerability AssessmentAI

Exploitation	Exploitation requires valid read:admin credentials in any realm of a vulnerable OpenRemote deployment running a version before 1.28.0. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 4.0 score of 8.3 is well-grounded: the network attack vector (AV:N), low complexity (AC:L), no attack requirements (AT:N), and low-privilege requirement (PR:L) together indicate any tenant admin can reach this endpoint with minimal friction. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	A tenant administrator in Realm A, authenticated with read:admin credentials, sends a single HTTP GET request to the OpenRemote notification endpoint with no query parameters using a standard tool such as curl. The API responds with the complete notification history from all realms on the deployment - including message bodies, recipient addresses, and timestamps belonging to Realm B, Realm C, and any other co-tenants. …
Remediation	Upgrade to OpenRemote 1.28.0 or later, which resolves the missing realm-scoped authorization check in the Notification REST API. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours, audit all tenant administrator accounts on OpenRemote deployments and immediately restrict Notification REST API access to only essential administrators; disable API privileges for non-critical admin accounts. …

Threat intelligence, references, and detailed analysis are available after sign-in.