OpenRemote, an open‑source IoT platform, has a cross‑realm information disclosure flaw in the UserResourceImpl class. The flaw resides in the get, getUserClientRoles, and getUserRealmRoles methods, which authorize callers with the read:admin role without verifying that the requested UUID belongs to the same tenant or realm. As a result, a tenant administrator can supply a user identifier from another tenant or the master realm and retrieve that user’s profile, client roles, and realm roles. This breaks tenant isolation and exposes privileged account information across tenant boundaries.

The vulnerability affects all OpenRemote installations prior to version 1.24.2. The affected product is the core OpenRemote server component, identified by openremote:openremote. Any deployment that has not yet applied the 1.24.2 release is susceptible. The issue is resolved in OpenRemote 1.24.2 and later.

The CVSS score of 7.7 indicates a high severity. The EPSS score is not available, so the exploitation probability cannot be quantified, but the lack of limitation on the read:admin role means that the attack can be performed by any user with that role in any realm. The vulnerability is not listed in CISA’s KEV catalog, yet the combination of authentication and privilege elevation (CWE‑639) means that an attacker with administrative privileges could expose sensitive information. The attack requires an authenticated session within a tenant that has read:admin rights; no additional network or local privileges are necessary beyond those normally granted to a tenant administrator.