What’s Vulnerable › Vulnerabilities

CVE-2026-73616: OpenRemote Notification Delete Cross-Realm Insecure Direct Object Reference

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-08-13 · updated 2026-09-23
• Weakness: CWE-639

Description

OpenRemote notification deletion endpoints fail to enforce realm boundaries, allowing any realm administrator to delete notifications belonging to other realms. Attackers with write:admin role in one realm can send DELETE requests to remove notifications from the master realm or other tenants without authorization checks.

Affected products

• openremote: all versions

References

• https://github.com/openremote/openremote/security/advisories/GHSA-rc23-4mmm-4fx9
• https://www.vulncheck.com/advisories/openremote-notification-delete-cross-realm-insecure-direct-object-reference
• https://github.com/openremote/openremote/security/advisories/GHSA-rc23-4mmm-4fx9

Get alerted when CVE-2026-73616 or the next vulnerability affects your stack