These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
CVE-2026-49439 debrief: OpenRemote predicted datapoint write endpoint allows unauthorized writes by users with 'read:assets' privileges before version 1.24.1, impacting defenders managing OpenRemote instances who must assess exposure and prioritize remediation to prevent potential unauthorized predicted datapoint writes and required verification of OpenRemote version and privileges. This issue requires de [truncated]
CVE-2026-81679 is a cross-realm information disclosure vulnerability in OpenRemote versions before 1.28.0. Attackers with read:admin credentials in one realm can read all tenants' sent notifications, including message bodies, by submitting a zero-parameter GET request to the notification endpoint. This issue allows per-realm tenant administrators to access sensitive information across different realms, po [truncated]
CVE-2026-73616 debrief based on CVE Program and NVD records. The vulnerability affects OpenRemote notification deletion endpoints, allowing unauthorized deletion across realms for administrators with write:admin roles. This issue impacts defenders responsible for OpenRemote deployments, who should assess exposure and verify configurations to mitigate potential risks. The CVE record and NVD entry provide d [truncated]
OpenRemote versions <= 1.26.2 contain an insecure direct object reference vulnerability in the setAssetLinks endpoint of AlarmResourceImpl. The realm access check validates only a single realm obtained via realms.stream().findFirst() on a HashSet of realms from the request, rather than all realms. This could allow an authenticated attacker to persist cross-tenant links and disclose victim asset names with [truncated]
CVE-2026-65009 is an information disclosure vulnerability in OpenRemote versions before 1.26.2. The SyslogResource REST endpoint fails to filter operational logs by realm, allowing attackers with the read:rules role to access the GET /api/{realm}/syslog/event endpoint and retrieve operational logs from all tenants, exposing asset IDs, agent connection details, rule names, and protocol errors across the mu [truncated]
CVE-2026-62238 is an authenticated SQL injection vulnerability in OpenRemote before 1.26.0. The vulnerability exists in the datapoint crosstab export endpoint, which constructs PostgreSQL queries by concatenating asset display names into raw SQL. An authenticated attacker with asset creation or rename permissions can inject SQL through the asset name parameter and receive query results in the exported CSV [truncated]
CVE-2026-56784 is an insecure direct object reference (IDOR) vulnerability in OpenRemote before version 1.25.0. The vulnerability exists in the bulk alarm deletion endpoint and allows authenticated users to permanently delete alarms belonging to other tenants by supplying arbitrary alarm IDs. This is possible because the removeAlarms() method in AlarmResourceImpl.java omits realm-scoping validation in its [truncated]
