Description
OpenRemote is an open-source internet-of-things platform. Prior to 1.24.2, the get, getUserClientRoles, and getUserRealmRoles methods in manager/src/main/java/org/openremote/manager/security/UserResourceImpl.java authorize callers with the read:admin role without confirming that the target UUID belongs to the requested and authenticated realm. A realm administrator can supply a user identifier from another tenant or the master realm and retrieve that user's profile, client roles, and realm roles, breaking tenant isolation and exposing privileged account information. This issue is fixed in version 1.24.2.
Published: 2026-10-13
Score: 7.7 High
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Remediation

No vendor fix or workaround currently provided.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Github GHSA Github GHSA GHSA-xqr9-4wvv-gvch OpenRemote has Cross-Realm User Information Disclosure in UserResourceImpl
History

Tue, 13 Oct 2026 18:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 13 Oct 2026 16:30:00 +0000

Type Values Removed Values Added
Description OpenRemote is an open-source internet-of-things platform. Prior to 1.24.2, the get, getUserClientRoles, and getUserRealmRoles methods in manager/src/main/java/org/openremote/manager/security/UserResourceImpl.java authorize callers with the read:admin role without confirming that the target UUID belongs to the requested and authenticated realm. A realm administrator can supply a user identifier from another tenant or the master realm and retrieve that user's profile, client roles, and realm roles, breaking tenant isolation and exposing privileged account information. This issue is fixed in version 1.24.2.
Title OpenRemote: Cross-Realm User Information Disclosure in UserResourceImpl
Weaknesses CWE-639
References
Metrics cvssV3_1

{'score': 7.7, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-10-13T17:12:20.894Z

Reserved: 2026-06-15T20:16:46.198Z

Link: CVE-2026-54641

cve-icon Vulnrichment

Updated: 2026-10-13T17:12:12.605Z

cve-icon NVD

Status : Deferred

Published: 2026-10-13T17:17:41.633

Modified: 2026-10-13T18:17:24.247

Link: CVE-2026-54641

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-13T18:30:07Z

Weaknesses
  • CWE-639

    Authorization Bypass Through User-Controlled Key