High severity · published Jun 23, 2026
CVE-2026-56784
OpenRemote < 1.25.0 IDOR via Bulk Alarm Deletion Endpoint
8.1
CVSS
0.3%
EPSS
No
On KEV
Description
OpenRemote before 1.25.0 contains an insecure direct object reference (IDOR) vulnerability in the bulk alarm deletion endpoint that allows authenticated users to permanently delete alarms belonging to other tenants by supplying arbitrary alarm IDs. The removeAlarms() method in AlarmResourceImpl.java omits realm-scoping validation in its JPA query, enabling any user with alarm-write permissions to enumerate sequential auto-increment alarm IDs and delete cross-tenant alarm records without authorization.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 25% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OP
openremote · openremote
before 1.25.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-56784
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-56784
vendor-advisory
https://github.com/openremote/openremote/security/advisories/GHSA-h3m5-97jq-qjrf
third-party-advisory
https://www.vulncheck.com/advisories/openremote-cross-tenant-idor-in-bulk-alarm-deletion
More from openremote
9.9
CVE-2026-39842
OpenRemote is Vulnerable to Expression Injection
9.8
CVE-2022-31860
An issue was discovered in OpenRemote through 1.0.4 allows attackers to execute arbitrary code via a crafted Groovy rule
9.3
CVE-2026-66013
OpenRemote before 1.26.2 Authentication Bypass via Console Registration
8.8
CVE-2026-62238
OpenRemote < 1.26.0 SQL Injection via Crosstab Export
8.5
CVE-2026-114661
OpenRemote 1.2.0 before 1.31.0 Missing Authorization in Gateway Tunnel Endpoints