OpenRemote versions before 1.26.2 contain a flaw in the Syslog REST endpoint that does not enforce realm isolation. A user with the read:rules role can send a GET request to /api/{realm}/syslog/event and retrieve operational logs from all tenants, exposing asset identifiers, agent connection details, rule names, and protocol errors. The vulnerability is a classic information exposure (CWE‑200).

OpenRemote (openremote:openremote) deployments running any version earlier than 1.26.2. The issue can affect any multi‑tenant instance where the read:rules role is granted, regardless of vendor or hosting environment.

The CVSS score of 5.3 indicates moderate severity, while the EPSS score of less than 1% suggests a low probability of exploitation in the wild. The vulnerability is not listed in CISA’s KEV catalog. Attackers must first obtain authentication with the read:rules role and then issue a standard REST call to the syslog event endpoint; the flaw allows access to logs that belong to other realms, resulting in a confidentiality breach across the entire tenant base.