OpenRemote before version 1.32.2 contains an improper authorization flaw that allows a realm administrator to call administrative endpoints that lack a super‑administrator check. The vulnerability enables the attacker to change the global Keycloak URL via the "/configuration/manager" endpoint, redirect authentication for other realms, inject custom CSS, replace map tiles, and delete logs, effectively compromising the integrity and confidentiality of all realms managed by the instance.

The affected product is OpenRemote Core, any deployment running a version earlier than 1.32.2. Users of the OpenRemote platform should verify that their installation is not running a vulnerable release.

The CVSS score of 8.6 categorizes this issue as high severity. The EPSS score is not available, and the vulnerability is not currently listed in CISA's KEV catalog. The attack vector is likely remote, through authenticated HTTP requests made by a user with realm‑administrator privileges; the attacker can exploit the flaw by sending carefully crafted API calls to the unprotected admin endpoints. Once an attacker achieves realm‑admin status — either by credential compromise or by leveraging another vulnerability — they can edit global settings and perform actions that affect all realms, creating significant risk for data integrity and user trust.