OpenRemote’s Manager API function updateUserRealmRoles does not verify the caller’s administrative privileges for the targeted realm. A user with write:admin access in any Keycloak realm can invoke this endpoint to modify role assignments for users in other realms, including the master realm. The flaw enables an attacker to grant themselves or others administrative rights in the master realm, effectively providing full control over the platform’s identity infrastructure. This is an Access Control issue (CWE‑284). Based on the description, it is inferred that an attacker possessing write:admin in any realm can exploit the Manager API by specifying an alternate realm in the request path.

The OpenRemote platform (openremote:openremote) versions prior to 1.22.1, including the 1.22.0 release, are affected. This includes all installations that have not yet been upgraded to 1.22.1 or later.

The CVSS score of 7 indicates a medium severity vulnerability. The exploit probability is unspecified (EPSS not available), and the issue is not listed in the CISA KEV catalog. An attacker can achieve privilege escalation by using documented API calls, but the attack requires authenticated access to the Manager API with the write:admin role in any realm. Because the flaw permits escalation to master realm administrator, the impact is high if the attacker succeeds, but no public exploitation has been reported to date.