# CVE-2026-41166: OpenRemote has Improper Access Control via updateUserRealmRoles function

Source: https://junglewise.ai/threats/cve-2026-41166-openremote-has-improper-access-control-via-updateuserrealmroles  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-22. Updated: 2026-05-11  
License: CC BY 4.0 with a link back

CVE-2026-41166 · Severity: high · CVSS 7 · Published 2026-04-22

OpenRemote is an open-source internet-of-things platform. Prior to version 1.22.1, a user who has `write:admin` in one Keycloak realm can call the Manager API to update Keycloak realm roles for users in another realm, including `master`. The handler uses the `{realm}` path segment when talking to the identity provider but does not check that the caller may administer that realm. This could result in a privilege escalation to `master` realm administrator if the attacker controls any user in `master` realm. Version 1.22.1 fixes the issue.

Technologies: [io.openremote:openremote-manager (Maven)](https://junglewise.ai/threats/technologies/io-openremote-openremote-manager), [OpenRemote](https://junglewise.ai/threats/technologies/openremote). Vendors: [Maven](https://junglewise.ai/threats/vendors/maven), [OpenRemote](https://junglewise.ai/threats/vendors/openremote).

## Quick answers

**Is CVE-2026-41166 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-41166 being exploited in the wild.

**How severe is CVE-2026-41166?** High severity, with a CVSS score of 7, published 22 April 2026.

**Which products and versions are affected?** io.openremote:openremote-manager (Maven) < 1.22.1, ECOSYSTEM:introduced=0,fixed=1.22.1.

**Is there a fix for CVE-2026-41166?** Yes. io.openremote:openremote-manager (Maven): upgrade to 1.22.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**Am I affected by CVE-2026-41166?** Check whether you run io.openremote:openremote-manager (Maven) or OpenRemote at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- io.openremote:openremote-manager (Maven): upgrade to 1.22.1 or later

  ```sh
  # set io.openremote:openremote-manager to 1.22.1 in your pom.xml or build.gradle
  ```


## Affected products

- io.openremote:openremote-manager (Maven) < 1.22.1, ECOSYSTEM:introduced=0,fixed=1.22.1
- OpenRemote

## Identifiers

- CVE-2026-41166
- GHSA-49vv-25qx-mg44

## References

- [https://api.github.com/users/KKC73](https://api.github.com/users/KKC73)
- [https://github.com/KKC73](https://github.com/KKC73)
- [https://api.github.com/users/KKC73/gists%7B/gist_id%7D](https://api.github.com/users/KKC73/gists%7B/gist_id%7D)
- [https://api.github.com/users/KKC73/repos](https://api.github.com/users/KKC73/repos)
- [https://avatars.githubusercontent.com/u/50138914?v=4](https://avatars.githubusercontent.com/u/50138914?v=4)
- [https://api.github.com/users/KKC73/events%7B/privacy%7D](https://api.github.com/users/KKC73/events%7B/privacy%7D)

## Related threats

- [OpenRemote authenticated SQL injection in datapoint export](https://junglewise.ai/threats/cve-2026-63224-openremote-is-an-open-source-internet-of-things-platform-prior-to)
- [OpenRemote Cross-Realm User Information Disclosure in UserResourceImpl](https://junglewise.ai/threats/cve-2026-54641-openremote-cross-realm-user-information-disclosure-in)
- [OpenRemote missing authorization for predicted datapoint writes](https://junglewise.ai/threats/cve-2026-49439-openremote-missing-authorization-for-predicted-datapoint-writes)
- [OpenRemote cross-realm information disclosure in Notification REST API](https://junglewise.ai/threats/cve-2026-81679-openremote-cross-realm-information-disclosure-in-notification)
- [OpenRemote notification deletion cross-realm authorization bypass](https://junglewise.ai/threats/cve-2026-73616-openremote-notification-deletion-cross-realm-authorization-bypass)