OpenRemote versions <= 1.26.2 contain an insecure direct object reference vulnerability in the setAssetLinks endpoint of AlarmResourceImpl. The realm access check validates only a single realm obtained via realms.stream().findFirst() on a HashSet of realms from the request, rather than all realms. This could allow an authenticated attacker to persist cross-tenant links and disclose victim asset names with [truncated]
CVE-2026-65009 is an information disclosure vulnerability in OpenRemote versions before 1.26.2. The SyslogResource REST endpoint fails to filter operational logs by realm, allowing attackers with the read:rules role to access the GET /api/{realm}/syslog/event endpoint and retrieve operational logs from all tenants, exposing asset IDs, agent connection details, rule names, and protocol errors across the mu [truncated]
CVE-2026-62238 is an authenticated SQL injection vulnerability in OpenRemote before 1.26.0. The vulnerability exists in the datapoint crosstab export endpoint, which constructs PostgreSQL queries by concatenating asset display names into raw SQL. An authenticated attacker with asset creation or rename permissions can inject SQL through the asset name parameter and receive query results in the exported CSV [truncated]
CVE-2026-56784 is an insecure direct object reference (IDOR) vulnerability in OpenRemote before version 1.25.0. The vulnerability exists in the bulk alarm deletion endpoint and allows authenticated users to permanently delete alarms belonging to other tenants by supplying arbitrary alarm IDs. This is possible because the removeAlarms() method in AlarmResourceImpl.java omits realm-scoping validation in its [truncated]
