OpenRemote versions 1.2.0 through 1.30.x expose a GatewayServiceResource that accepts authenticated HTTP requests to start, stop, or query gateway tunnels without verifying that the caller has an administrative role. As a result, any authenticated user can initiate or terminate persistent TCP tunnels between the central server and edge gateways, creating a bidirectional circuit into a gateway’s internal network or dismantling existing tunnels. This missing authorization allows potential data exfiltration, unauthorized network access, or denial‑of‑service conditions and is classified as CWE‑862.

The affected product is OpenRemote from the openremote vendor. All releases from 1.2.0 up to, but not including, 1.31.0 are vulnerable. The flaw resides in the GatewayServiceResource endpoints that provide tunnel control, and every instance of those versions is impacted.

The vulnerability carries a CVSS score of 9, indicating a high‑severity flaw. No EPSS score is currently available, and it is not listed in the CISA KEV catalog, so the exact likelihood of exploitation is unknown. Attackers require only authenticated access to issue HTTP POST or DELETE requests to the /gateway/tunnel endpoint; no elevated system privileges are necessary. Because the flaw can be leveraged remotely by any authenticated user, it poses a critical risk for unauthorized network access and potential compromise.