# CVE-2026-54641: OpenRemote Cross-Realm User Information Disclosure in UserResourceImpl

Source: https://junglewise.ai/threats/cve-2026-54641-openremote-cross-realm-user-information-disclosure-in  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-13. Updated: 2026-07-06  
License: CC BY 4.0 with a link back

CVE-2026-54641 · Severity: high · CVSS 7.7 · Published 2026-10-13

OpenRemote, an open-source IoT platform, contains a vulnerability that allows an administrator of one organization (tenant) to view sensitive information about users in other organizations, including the master system administrator. By exploiting this flaw, a malicious tenant admin can access user profiles, email addresses, and security roles across the entire platform. This breaks the isolation between different customers on a shared server and could be used to plan further attacks against high-level system accounts.

Technologies: [io.openremote:openremote-manager (Maven)](https://junglewise.ai/threats/technologies/io-openremote-openremote-manager). Vendors: [Maven](https://junglewise.ai/threats/vendors/maven).

## Quick answers

**Is CVE-2026-54641 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-54641 being exploited in the wild.

**How severe is CVE-2026-54641?** High severity, with a CVSS score of 7.7, published 13 October 2026.

**Which products and versions are affected?** io.openremote:openremote-manager (Maven) < 1.24.2, ECOSYSTEM:introduced=0,fixed=1.24.2.

**Is there a fix for CVE-2026-54641?** Yes. io.openremote:openremote-manager (Maven): upgrade to 1.24.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-54641 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-54641?** Check whether you run io.openremote:openremote-manager (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- io.openremote:openremote-manager (Maven): upgrade to 1.24.2 or later

  ```sh
  # set io.openremote:openremote-manager to 1.24.2 in your pom.xml or build.gradle
  ```


## Technical details

An Insecure Direct Object Reference (IDOR) vulnerability exists in the UserResourceImpl.java component of OpenRemote Manager. Three REST API read endpoints (get, getUserClientRoles, and getUserRealmRoles) fail to validate that the requested user UUID belongs to the same realm as the authenticated caller. While these methods check for the 'read:admin' role, they lack the 'throwIfCannotAdminRealm' guard present in write-side methods. An attacker with realm-administrator privileges in any tenant can provide a target user's UUID to bypass realm boundaries and retrieve profiles and Keycloak roles from other realms, including the master realm. This issue is tracked as CVE-2026-54641 and is fixed in version 1.24.2.

## Affected products

- OpenRemote openremote-manager < 1.24.2

## Identifiers

- CVE-2026-54641
- GHSA-xqr9-4wvv-gvch

## Timeline

- 2026-06-12: patched: Fix committed to repository
- 2026-07-06: advisory: GHSA-xqr9-4wvv-gvch published

## References

- [https://api.github.com/users/geo-chen](https://api.github.com/users/geo-chen)
- [https://github.com/geo-chen](https://github.com/geo-chen)
- [https://api.github.com/users/geo-chen/gists%7B/gist_id%7D](https://api.github.com/users/geo-chen/gists%7B/gist_id%7D)
- [https://api.github.com/users/geo-chen/repos](https://api.github.com/users/geo-chen/repos)
- [https://avatars.githubusercontent.com/u/2404584?v=4](https://avatars.githubusercontent.com/u/2404584?v=4)
- [https://api.github.com/users/geo-chen/events%7B/privacy%7D](https://api.github.com/users/geo-chen/events%7B/privacy%7D)

## Related threats

- [OpenRemote missing authorization for predicted datapoint writes](https://junglewise.ai/threats/cve-2026-49439-openremote-missing-authorization-for-predicted-datapoint-writes)
- [OpenRemote SQL injection in datapoint crosstab export](https://junglewise.ai/threats/cve-2026-62238-openremote-sql-injection-in-datapoint-crosstab-export)
- [OpenRemote Manager removeAlarms cross-realm IDOR](https://junglewise.ai/threats/openremote-manager-removealarms-cross-realm-idor-224ba6c2)
- [OpenRemote IDOR in bulk alarm deletion endpoint](https://junglewise.ai/threats/cve-2026-56120-openremote-idor-in-bulk-alarm-deletion-endpoint)
- [OpenRemote has Improper Access Control via updateUserRealmRoles function](https://junglewise.ai/threats/cve-2026-41166-openremote-has-improper-access-control-via-updateuserrealmroles)