# CVE-2026-73616: OpenRemote notification deletion cross-realm authorization bypass

Source: https://junglewise.ai/threats/cve-2026-73616-openremote-notification-deletion-cross-realm-authorization-bypass  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-13. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-73616 · Severity: medium · CVSS 6.5 · Published 2026-08-13

OpenRemote is an open-source IoT platform that manages notifications across multiple customer tenants (realms). A flaw in the notification deletion API allows any tenant administrator to delete notifications belonging to other customers' environments, including the master realm. This enables data destruction and operational disruption across organization boundaries without proper authorization.

Technologies: [OpenRemote](https://junglewise.ai/threats/technologies/openremote). Vendors: [OpenRemote](https://junglewise.ai/threats/vendors/openremote).

## Quick answers

**Is CVE-2026-73616 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-73616 being exploited in the wild.

**How severe is CVE-2026-73616?** Medium severity, with a CVSS score of 6.5, published 13 August 2026.

**Which products and versions are affected?** OpenRemote <= 1.27.1.

**Is there a fix for CVE-2026-73616?** A patch was published on 2026: Patched in version 1.28.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-73616 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-73616?** Check whether you run OpenRemote at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a cross-realm Insecure Direct Object Reference (IDOR) / authorization bypass in the notification deletion endpoints of NotificationResourceImpl.java. The delete methods (removeNotifications and removeNotification) only check for the write:admin role without validating that the caller's realm matches the target notification's realm, unlike the hardened read path which calls resolveAndAuthoriseRealm(). An authenticated user with write:admin role in one realm can send DELETE requests with arbitrary notification IDs or realm parameters to removeNotifications(), bypassing realm boundary checks. The root cause mirrors CVE-2026-57168 (removeAlarms IDOR), where role-based access control was enforced but per-object realm validation was omitted. The underlying NotificationService.removeNotification(Long id) executes a bare delete with no realm filter. Patch is available in version 1.28.0.

## Affected products

- OpenRemote OpenRemote <= 1.27.1

## Timeline

- 2026-07-29: disclosed
- 2026-08-13: advisory
- 2026: patched: Patched in version 1.28.0

## References

- [https://github.com/openremote/openremote/security/advisories/GHSA-rc23-4mmm-4fx9](https://github.com/openremote/openremote/security/advisories/GHSA-rc23-4mmm-4fx9)
- [https://www.vulncheck.com/advisories/openremote-notification-delete-cross-realm-insecure-direct-object-reference](https://www.vulncheck.com/advisories/openremote-notification-delete-cross-realm-insecure-direct-object-reference)

## Related threats

- [OpenRemote authenticated SQL injection in datapoint export](https://junglewise.ai/threats/cve-2026-63224-openremote-is-an-open-source-internet-of-things-platform-prior-to)
- [OpenRemote cross-realm information disclosure in Notification REST API](https://junglewise.ai/threats/cve-2026-81679-openremote-cross-realm-information-disclosure-in-notification)
- [OpenRemote insecure direct object reference in setAssetLinks](https://junglewise.ai/threats/cve-2026-67310-openremote-insecure-direct-object-reference-in-setassetlinks)
- [OpenRemote authentication bypass in console registration API](https://junglewise.ai/threats/cve-2026-66013-openremote-authentication-bypass-in-console-registration-api)
- [OpenRemote information disclosure in SyslogResource REST endpoint](https://junglewise.ai/threats/cve-2026-65009-openremote-information-disclosure-in-syslogresource-rest-endpoint)