CVE-2026-73616

Summary

OpenRemote notification deletion endpoints fail to enforce realm boundaries, allowing any realm administrator to delete notifications belonging to other realms. Attackers with write:admin role in one realm can send DELETE requests to remove notifications from the master realm or other tenants without authorization checks.

Affected Software

Weaknesses

• CWE-639: Authorization Bypass Through User-Controlled Key

ADP Enrichment

CISA ADP Vulnrichment

• SSVC:
• Exploitation: poc
  • Automatable: no
  • Technical Impact: partial

Additional References

• https://github.com/openremote/openremote/security/advisories/GHSA-rc23-4mmm-4fx9

References

• https://github.com/openremote/openremote/security/advisories/GHSA-rc23-4mmm-4fx9
• https://www.vulncheck.com/advisories/openremote-notification-delete-cross-realm-insecure-direct-object-reference

• ←Previous
• Next→