Executive brief
OpenRemote, an open-source IoT device management platform, contains a security flaw in how it handles the deletion of multiple system alarms. An authorized user from one organization can intentionally delete or view the existence of alarms belonging to other organizations using the same system. This could lead to the permanent loss of critical safety or security alerts and disrupt operations for other customers on a shared server.
Technical details
An Insecure Direct Object Reference (IDOR) vulnerability exists in the `removeAlarms()` method within `AlarmResourceImpl.java`. While the singular deletion method correctly validates realm-scoping, the bulk deletion endpoint only verifies that the requester's own realm is active and fails to check if the targeted alarm IDs belong to the requester's tenant. Because alarm IDs are sequential auto-incrementing values, an authenticated attacker with alarm-write permissions can enumerate and delete cross-tenant alarm records via the JPA query in `AlarmService.java`, which lacks realm-based filtering. This issue is resolved in version 1.25.0.
Affected products
- OpenRemote OpenRemote < 1.25.0
Timeline
- 2026-06-18: patched: Version 1.25.0 released
- 2026-06-19: advisory: GitHub Security Advisory published
- 2026-06-23: disclosed: CVE published to NVD