Technical impact
The vulnerability arises from an authorization bypass in the GatewayService, which only verifies the gateway ID without checking the owning realm. Consequently, a user with WRITE:ADMIN permissions in one realm can create a service user named after another realm's gateway ID and overwrite that gateway’s assets, thereby establishing SSH tunnels into the other realm’s local network. This bypass enables attackers to impersonate gateways across realms, resulting in unauthorized network access, potential data exfiltration, and lateral movement within the infrastructure.
Affected Systems
OpenRemote core, before version 1.31.0, is affected. The issue is scoped to deployments where multiple realms exist and realm administrators have WRITE:ADMIN rights. Version 1.31.0 and later contain the fix.
Risk and Exploitability
The CVSS score of 2.1 indicates a low base severity, and there is no EPSS information or KEV listing for this vulnerability. The attack requires a legitimate realm administrator who can add service users, which implies internal access or an already compromised administrator account. Once the exploit is performed, the attacker can control outbound SSH tunnels from the impersonated gateway, potentially reaching downstream systems. The exploit condition is simple: create a service user with a gateway ID from another realm; no additional privilege escalation steps beyond the existing WRITE:ADMIN role are needed.
