Executive brief
OpenRemote Manager is an IoT platform used to integrate and manage smart buildings and automation systems across multiple customer tenants. An authenticated user with alarm write permissions can delete safety-critical and security alarms belonging to other tenants by exploiting a missing authorization check, causing permanent loss of alert records and undermining the integrity of the monitoring and alerting system.
Technical details
The vulnerability is an Insecure Direct Object Reference (IDOR) in the bulk alarm deletion endpoint (removeAlarms method in AlarmResourceImpl.java). The vulnerable code verifies that the authenticated user's own realm is active and accessible, but fails to validate that the targeted alarm IDs belong to the caller's realm before deletion. Because alarm IDs are sequential auto-increment values, attackers can enumerate IDs and delete cross-tenant alarm records. The singular removeAlarm() method correctly validates per-alarm realm authorization, but the plural removeAlarms() lacks this check in its underlying JPA queries. An attacker requires only alarm write permissions in their own realm to exploit this flaw and permanently destroy alarms in any other tenant's realm.
Affected products
- OpenRemote Manager < 1.25.0
Timeline
- 2026-06-19: disclosed
- 2026-06-23: advisory
- 2026-09-24: other: Advisory withdrawn as duplicate of GHSA-h3m5-97jq-qjrf