Authorization Flaw in OpenRemote IoT Platform
CVE-2026-54641

7.7HIGH

Key Information:

Vendor

Openremote

Status
Openremote
Vendor
CVE Published:
13 October 2026

What is CVE-2026-54641?

OpenRemote, an open-source internet-of-things platform, has a significant authorization flaw affecting its security. Prior to version 1.24.2, certain methods in the application permitted callers with the read:admin role to access user information without verifying the ownership of the target UUID in the authenticated realm. This failure to confirm user authority allows a realm administrator to exploit the system by using a user identifier from another tenant or the master realm, subsequently retrieving sensitive information such as user profiles, client roles, and realm roles, thereby compromising tenant isolation and exposing privileged account data. This vulnerability was addressed in version 1.24.2.

Affected Version(s)

openremote < 1.24.2

References

https://github.com/openremote/core/security/advisories/GH...
x_refsource_CONFIRM
https://github.com/openremote/core/commit/de89b8d3af272d7...
x_refsource_MISC
https://github.com/openremote/core/releases/tag/1.24.2
x_refsource_MISC

CVSS V3.1

Score:
7.7
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.