CVE-2026-54641 Details
Description
OpenRemote is an open-source internet-of-things platform. Prior to 1.24.2, the get, getUserClientRoles, and getUserRealmRoles methods in manager/src/main/java/org/openremote/manager/security/UserResourceImpl.java authorize callers with the read:admin role without confirming that the target UUID belongs to the requested and authenticated realm. A realm administrator can supply a user identifier from another tenant or the master realm and retrieve that user's profile, client roles, and realm roles, breaking tenant isolation and exposing privileged account information. This issue is fixed in version 1.24.2.
A cross-realm user information disclosure vulnerability has been identified in OpenRemote versions prior to 1.24.2. The issue arises in the UserResourceImpl class, where certain methods authorize users with the read:admin role without verifying that the target user UUID belongs to the same realm as the requester. This flaw allows a realm administrator to access profiles, client roles, and realm roles of users from other realms, including the master realm, thereby breaching tenant isolation and exposing sensitive account information.
Users can upgrade to OpenRemote version 1.24.2 or later, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 13, 2026CISA-ADP
Assessed Oct 13, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/openremote/core/security/advisories/GHSA-xqr9-4wvv-gvch | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/openremote/core/commit/de89b8d3af272d717bf297934c2cbc97243f08b7 | [email protected] | Source CodeVendor |
| https://github.com/openremote/core/releases/tag/1.24.2 | [email protected] | Release NotesVendor |
| https://github.com/openremote/core/security/advisories/GHSA-xqr9-4wvv-gvch | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-639 | Authorization Bypass Through User-Controlled Key | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| OpenRemote | <= 1.24.1 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 13, 2026 | CVE Modified | CISA-ADP |
| Oct 13, 2026 | New CVE Received | [email protected] |