CVE-2026-56120: OpenRemote IDOR in bulk alarm deletion endpoint

CVE-2026-56120 · Severity: high · CVSS 8.1 · Published 2026-06-23

OpenRemote, an open-source IoT device management platform, contains a security flaw in how it handles the deletion of multiple system alarms. An authorized user from one organization can intentionally delete or view the existence of alarms belonging to other organizations using the same system. This could lead to the permanent loss of critical safety or security alerts and disrupt operations for other customers on a shared server.

Technologies: io.openremote:openremote-manager (Maven), OpenRemote. Vendors: Maven, OpenRemote.

Quick answers

Is CVE-2026-56120 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-56120 being exploited in the wild.
How severe is CVE-2026-56120?
High severity, with a CVSS score of 8.1, published 23 June 2026.
Which products and versions are affected?
io.openremote:openremote-manager (Maven) ECOSYSTEM:introduced=0,fixed=1.25.0; OpenRemote < 1.25.0.
Is there a fix for CVE-2026-56120?
Yes. io.openremote:openremote-manager (Maven): upgrade to 1.25.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-56120 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-56120?
Check whether you run io.openremote:openremote-manager (Maven) or OpenRemote at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • io.openremote:openremote-manager (Maven): upgrade to 1.25.0 or later
    # set io.openremote:openremote-manager to 1.25.0 in your pom.xml or build.gradle

Technical details

An Insecure Direct Object Reference (IDOR) vulnerability exists in the `removeAlarms()` method within `AlarmResourceImpl.java`. While the singular deletion method correctly validates realm-scoping, the bulk deletion endpoint only verifies that the requester's own realm is active and fails to check if the targeted alarm IDs belong to the requester's tenant. Because alarm IDs are sequential auto-incrementing values, an authenticated attacker with alarm-write permissions can enumerate and delete cross-tenant alarm records via the JPA query in `AlarmService.java`, which lacks realm-based filtering. This issue is resolved in version 1.25.0.

Affected products

  • OpenRemote OpenRemote < 1.25.0

Identifiers

  • CVE-2026-56120
  • GHSA-h3m5-97jq-qjrf

Timeline

  • 2026-06-18: patched: Version 1.25.0 released
  • 2026-06-19: advisory: GitHub Security Advisory published
  • 2026-06-23: disclosed: CVE published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.