CVE-2026-56784

OpenRemote < 1.25.0 IDOR via Bulk Alarm Deletion Endpoint

Published Jun 23, 2026 CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed

Description

OpenRemote before 1.25.0 contains an insecure direct object reference (IDOR) vulnerability in the bulk alarm deletion endpoint that allows authenticated users to permanently delete alarms belonging to other tenants by supplying arbitrary alarm IDs. The removeAlarms() method in AlarmResourceImpl.java omits realm-scoping validation in its JPA query, enabling any user with alarm-write permissions to enumerate sequential auto-increment alarm IDs and delete cross-tenant alarm records without authorization.

Analysis

Technical impact

OpenRemote before 1.25.0 contains an insecure direct object reference (IDOR) vulnerability in the bulk alarm deletion endpoint that allows authenticated users to permanently delete alarms belonging to other tenants by supplying arbitrary alarm IDs. The removeAlarms() method in AlarmResourceImpl.java omits realm‑scoping validation in its JPA query, enabling any user with alarm‑write permissions to enumerate sequential auto‑increment alarm IDs and delete cross‑tenant alarm records without authorization.

Affected Systems

The affected product is OpenRemote from the vendor OpenRemote. All releases before 1.25.0 are impacted, including any deployments where the bulk alarm deletion functionality is enabled. No specific sub‑products are mentioned.

Risk and Exploitability

The CVSS score of 8.6 indicates High severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires valid user credentials with alarm‑write permissions; no additional privileges are needed. The attacker can remotely invoke the bulk deletion API and delete alarms across tenant boundaries, leading to loss of critical safety data.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

openremote

unaffected

Version	Status	Constraints
`0`	affected	< 1.25.0
`1.25.0`	unaffected	—

No data.

Vendor Product Versions

Openremote

Version	Status	Scheme	Platform
`[0,1.24.2)`	affected	semver	—
`1.24.2`	unaffected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade OpenRemote to version 1.25.0 or later
Restrict access to the removeAlarms endpoint so that only tenant administrators can invoke it
Enable and review audit logs for abnormal bulk alarm deletion activity and investigate suspicious events

Generated by OpenCVE AI on June 24, 2026 at 09:25 UTC.

Tracking

Advisories

No advisories available

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact High

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.326% probability within 30 days)

Exploitation poc

Automatable no

Technical Impact partial

References

Link	Providers
https://github.com/openremote/openremote/security/advisories/GHSA-h3m5-97jq-qjrf
https://www.vulncheck.com/advisories/openremote-cross-tenant-idor-in-bulk-alarm-deletion

History

Jun 23, 2026 9:45 PM Description updated. Title updated. References updated. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description	OpenRemote Manager before 1.24.2 contains an insecure direct object reference vulnerability in the removeAlarms() method that allows authenticated users to delete alarms from other tenants by supplying arbitrary alarm IDs. The bulk deletion endpoint fails to validate that targeted alarm IDs belong to the caller's realm, enabling cross-tenant permanent destruction of safety-critical and security alerts.	OpenRemote before 1.25.0 contains an insecure direct object reference (IDOR) vulnerability in the bulk alarm deletion endpoint that allows authenticated users to permanently delete alarms belonging to other tenants by supplying arbitrary alarm IDs. The removeAlarms() method in AlarmResourceImpl.java omits realm-scoping validation in its JPA query, enabling any user with alarm-write permissions to enumerate sequential auto-increment alarm IDs and delete cross-tenant alarm records without authorization.
Title	OpenRemote Manager - Cross-Tenant IDOR in Bulk Alarm Deletion	OpenRemote < 1.25.0 IDOR via Bulk Alarm Deletion Endpoint
References	https://www.vulncheck.com/advisories/openremote-manager-cross-tenant-idor-in-bulk-alarm-deletion	https://www.vulncheck.com/advisories/openremote-cross-tenant-idor-in-bulk-alarm-deletion
Metrics	cvssV3_1 `{'score': 8.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H'}` cvssV4_0 `{'score': 7.2, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N'}`	cvssV3_1 `{'score': 8.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N'}` cvssV4_0 `{'score': 8.6, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N'}`

Jun 23, 2026 3:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Jun 23, 2026 12:45 PM Description updated. Title updated. First appearance in the feed. Weaknesses updated. Affected versions updated. Affected vendors updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		OpenRemote Manager before 1.24.2 contains an insecure direct object reference vulnerability in the removeAlarms() method that allows authenticated users to delete alarms from other tenants by supplying arbitrary alarm IDs. The bulk deletion endpoint fails to validate that targeted alarm IDs belong to the caller's realm, enabling cross-tenant permanent destruction of safety-critical and security alerts.
Title		OpenRemote Manager - Cross-Tenant IDOR in Bulk Alarm Deletion
First Time appeared		Openremote Openremote openremote
Weaknesses		CWE-639
CPEs		cpe:2.3:a:openremote:openremote::::::::
Vendors & Products		Openremote Openremote openremote
References		https://github.com/openremote/openremote/security/advisories/GHSA-h3m5-97jq-qjrf https://www.vulncheck.com/advisories/openremote-manager-cross-tenant-idor-in-bulk-alarm-deletion
Metrics		cvssV3_1 `{'score': 8.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H'}` cvssV4_0 `{'score': 7.2, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N'}`