PatchSiren

openremote CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

HIGH openremote CVE published 2026-06-23

CVE-2026-56784

CVE-2026-56784 is an insecure direct object reference (IDOR) vulnerability in OpenRemote before version 1.25.0. The vulnerability exists in the bulk alarm deletion endpoint and allows authenticated users to permanently delete alarms belonging to other tenants by supplying arbitrary alarm IDs. This is possible because the removeAlarms() method in AlarmResourceImpl.java omits realm-scoping validation in its [truncated]