Executive brief
OpenRemote Manager, an open-source IoT platform used for managing smart cities and industrial systems, contains a security flaw in its alarm management system. An authorized user from one organization can delete critical safety and security alerts belonging to other organizations on the same platform. This could lead to the permanent loss of important security history and the suppression of active emergency notifications across different customers.
Technical details
An Insecure Direct Object Reference (IDOR) vulnerability exists in the `removeAlarms()` method within `AlarmResourceImpl.java`. While the singular `removeAlarm()` method correctly validates realm ownership, the bulk deletion endpoint only verifies that the requester's own realm is active. It fails to perform per-object authorization checks on the provided list of alarm IDs. Because alarm IDs are sequential auto-incrementing values, an authenticated attacker can guess IDs belonging to other tenants and delete them via the bulk endpoint. This allows for cross-tenant data destruction and enumeration of alarm presence. The issue is fixed in version 1.24.2.
Affected products
- OpenRemote OpenRemote Manager < 1.24.2
Timeline
- 2026-06-19: advisory: GitHub Security Advisory published
- 2026-06-23: disclosed: NVD publication date