OpenRemote Manager cross-realm IDOR in bulk alarm deletion

Executive brief

OpenRemote Manager, an open-source IoT management platform, contains a security flaw that allows a user from one organization to delete alarms belonging to another organization. This could lead to the permanent loss of critical safety or security alerts across different customers sharing the same system. An attacker only needs a standard account on the system to perform this bulk deletion.

Technical details

An Insecure Direct Object Reference (IDOR) exists in the `removeAlarms` method of `AlarmResourceImpl.java`. While the singular `removeAlarm` method correctly validates realm ownership, the bulk deletion method only verifies that the requester's own realm is active. It fails to check if the provided list of alarm IDs belongs to the requester's realm. Because alarm IDs are sequential auto-incrementing values, an authenticated attacker can enumerate and delete alarms across all tenants (realms) via the `/api/smartcity/alarm` endpoint. This has been patched in version 1.24.2.

Affected products

• OpenRemote OpenRemote Manager < 1.24.2

Timeline

• 2026-06-19: advisory
• 2026-06-19: patched: Version 1.24.2 released

References

• https://api.github.com/users/Forklit
• https://github.com/Forklit
• https://api.github.com/users/Forklit/gists%7B/gist_id%7D
• https://api.github.com/users/Forklit/repos
• https://avatars.githubusercontent.com/u/118192250?v=4
• https://api.github.com/users/Forklit/events%7B/privacy%7D