OpenRemote versions before 1.26.0 include an authenticated SQL injection flaw in the datapoint crosstab export endpoint. The code constructs PostgreSQL queries by concatenating asset display names directly into raw SQL. An attacker who has asset creation or rename permissions can supply a crafted asset name, inject arbitrary SQL, and receive the query results in the exported CSV file. This flaw allows the attacker to read sensitive database information, violating confidentiality and potentially exposing business or personal data. The weakness is a classic input‑validation failure classified as CWE‑89.

The affected product is OpenRemote from the openremote vendor. All releases prior to 1.26.0 are vulnerable; no later revision is known to be patched.

The CVSS base score of 7.2 signals a high‑severity vulnerability, but the EPSS score of less than 1% suggests it is currently considered unlikely to be widely exploited. The flaw is not listed in CISA’s KEV catalog. Exploitation requires legitimate credentials with at least asset creation or rename authority; therefore, the threat vector is authenticated. Once the injection occurs, the attacker can exfiltrate data directly through the CSV response, making it a straightforward yet potent data theft channel.