CVE-2026-54641: OpenRemote Cross-Realm User Information Disclosure in UserResourceImpl

CVE-2026-54641 · Severity: high · CVSS 7.7 · Published 2026-10-13

OpenRemote, an open-source IoT platform, contains a vulnerability that allows an administrator of one organization (tenant) to view sensitive information about users in other organizations, including the master system administrator. By exploiting this flaw, a malicious tenant admin can access user profiles, email addresses, and security roles across the entire platform. This breaks the isolation between different customers on a shared server and could be used to plan further attacks against high-level system accounts.

Technologies: io.openremote:openremote-manager (Maven). Vendors: Maven.

Quick answers

Is CVE-2026-54641 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-54641 being exploited in the wild.
How severe is CVE-2026-54641?
High severity, with a CVSS score of 7.7, published 13 October 2026.
Which products and versions are affected?
io.openremote:openremote-manager (Maven) < 1.24.2, ECOSYSTEM:introduced=0,fixed=1.24.2.
Is there a fix for CVE-2026-54641?
Yes. io.openremote:openremote-manager (Maven): upgrade to 1.24.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-54641 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-54641?
Check whether you run io.openremote:openremote-manager (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • io.openremote:openremote-manager (Maven): upgrade to 1.24.2 or later
    # set io.openremote:openremote-manager to 1.24.2 in your pom.xml or build.gradle

Technical details

An Insecure Direct Object Reference (IDOR) vulnerability exists in the UserResourceImpl.java component of OpenRemote Manager. Three REST API read endpoints (get, getUserClientRoles, and getUserRealmRoles) fail to validate that the requested user UUID belongs to the same realm as the authenticated caller. While these methods check for the 'read:admin' role, they lack the 'throwIfCannotAdminRealm' guard present in write-side methods. An attacker with realm-administrator privileges in any tenant can provide a target user's UUID to bypass realm boundaries and retrieve profiles and Keycloak roles from other realms, including the master realm. This issue is tracked as CVE-2026-54641 and is fixed in version 1.24.2.

Affected products

  • OpenRemote openremote-manager < 1.24.2

Identifiers

  • CVE-2026-54641
  • GHSA-xqr9-4wvv-gvch

Timeline

  • 2026-06-12: patched: Fix committed to repository
  • 2026-07-06: advisory: GHSA-xqr9-4wvv-gvch published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.