Technical impact
OpenRemote core before version 1.31.0 does not enforce realm or gateway authorization on inbound edge gateway events, and it maps event asset IDs using the reversible GatewayConnector.mapAssetId transform. An attacker controlling a registered gateway can craft pre‑image IDs in AttributeEvent or DELETE AssetEvent messages to overwrite attributes on, or delete, assets in any realm, thereby breaking tenant isolation and allowing unauthorized modification of data across tenants.
Affected Systems
The affected product is OpenRemote core, also known as openremote-manager, for all releases before 1.31.0. Versions without the fix lack the proper authorization checks on inbound edge gateway events.
Risk and Exploitability
The CVSS score of 2.3 indicates low overall severity, and the EPSS score is unavailable, suggesting no known widespread exploitation. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector requires an attacker to control a registered gateway and send crafted event messages, so it is most relevant to environments where gateways are exposed or where gateway authorities are not tightly restricted. If these conditions exist, an attacker can bypass authorization and tamper with or delete assets in any realm.
