The vulnerability is an insecure direct object reference located in the setAssetLinks endpoint of AlarmResourceImpl. It allows an authenticated user to add alarm‑asset links that belong to a different tenant’s realm. When the endpoint returns link data, the attacker can view asset names that belong to the victim realm through GET requests on the attacker’s own alarm. This constitutes a confidentiality breach of cross‑tenant data.

OpenRemote software, vendor OpenRemote, product OpenRemote, versions up to and including 1.26.2. The issue was addressed in release 1.27.0 and later.

The CVSS score of 5.3 indicates moderate severity. EPSS is not available, and the vulnerability is not listed in CISA KEV. Exploitation requires an authenticated attacker, but because HashSet iteration is nondeterministic, each request has roughly a 50% chance to succeed, making it retryable. While the likelihood of widespread exploitation remains low, an attacker who can repeatedly attempt the operation can eventually achieve data disclosure.