Technical impact
OpenRemote core before version 1.31.0 has an authorization bypass that lets a logged‑in user query the getGatewayActiveTunnelInfos endpoint for any realm. The response reveals internal host names, port numbers and routing details that belong to other realms, exposing confidential network topology without requiring elevated rights. The flaw is catalogued as CWE‑639.
Affected Systems
Products affected by the vulnerability are OpenRemote core and any deployments that use a version earlier than 1.31.0. The issue has been identified for all releases of the OpenRemote core prior to that release date.
Risk and Exploitability
The CVSS score of 5.3 places the issue in the medium severity range, and there is no EPSS score available, meaning there is not enough data to assess current exploitation likelihood. The vulnerability is not listed in the CISA KEV catalogue. An attacker must already have an authenticated account to trigger the exploit. Based on the description, the endpoint does not enforce realm isolation, indicating that the attack vector is local to the application exposure. Once authenticated, the attacker can obtain sensitive tunnel configuration data from other realms, potentially aiding further attacks.
