Access Control Flaw in OpenRemote IoT Platform by OpenRemote
CVE-2026-49439

4.3MEDIUM

Key Information:

Vendor

Openremote

Status
Openremote
Vendor
CVE Published:
11 September 2026

What is CVE-2026-49439?

OpenRemote, an open-source internet-of-things platform, has a notable access control vulnerability in its predicted datapoint write endpoint. Users with only basic read:assets permissions can maliciously write predicted datapoints, compromising the integrity of the data within the system. This issue has been resolved in version 1.24.1, which restricts the write capability to users with appropriate permissions, enhancing security and data reliability.

Affected Version(s)

openremote < 1.24.1

References

https://github.com/openremote/openremote/security/advisor...
x_refsource_CONFIRM
https://github.com/openremote/openremote/commit/583dbbfb9...
x_refsource_MISC

CVSS V3.1

Score:
4.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.