CVE-2026-67310 | BDVDB-2026-354595 Detail

Description#

OpenRemote (org.openremote:openremote) versions <= 1.26.2 contain an insecure direct object reference vulnerability in the setAssetLinks endpoint of AlarmResourceImpl. The realm access check validates only a single realm obtained via realms.stream().findFirst() on a HashSet of realms from the request, rather than all realms. Because HashSet iteration order is non-deterministic, an authenticated attacker who includes alarm-asset links from both their own realm and a victim realm can, with roughly 50% probability per request (retryable), persist cross-tenant links and disclose victim asset names (returned via @Formula fields) through GET requests on the attacker's own alarm. Fixed in 1.27.0.

Impact#

Weaknesses#

References#

Exploit#

History#

1. Version 12026-08-01Record published in the CVE List.
2. Version 22026-10-08Most recent update recorded in the CVE List.