CVE-2026-67310
Received Received - Intake

Insecure Direct Object Reference in OpenRemote

Publication date: 2026-08-01

Last updated on: 2026-08-01

Assigner: VulnCheck

Description
OpenRemote (org.openremote:openremote) versions <= 1.26.2 contain an insecure direct object reference vulnerability in the setAssetLinks endpoint of AlarmResourceImpl. The realm access check validates only a single realm obtained via realms.stream().findFirst() on a HashSet of realms from the request, rather than all realms. Because HashSet iteration order is non-deterministic, an authenticated attacker who includes alarm-asset links from both their own realm and a victim realm can, with roughly 50% probability per request (retryable), persist cross-tenant links and disclose victim asset names (returned via @Formula fields) through GET requests on the attacker's own alarm. Fixed in 1.27.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-01
Last Modified
2026-08-01
Generated
2026-08-01
AI Q&A
2026-08-01
EPSS Evaluated
N/A
NVD
CVE-2026-67310
EUVD
EUVD-2026-51838

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
openremote openremote to 1.27.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

OpenRemote versions 1.26.2 and earlier have an insecure direct object reference flaw in the AlarmResourceImpl setAssetLinks endpoint. The system checks realm access using only one realm from a HashSet, which has non-deterministic iteration order. This allows an attacker to include links from both their realm and a victim's realm, potentially creating cross-tenant links and exposing victim asset names through GET requests.

Detection Guidance

Check OpenRemote versions <= 1.26.2 for the setAssetLinks endpoint in AlarmResourceImpl. Monitor for cross-tenant asset link persistence and unauthorized access attempts. Review logs for repeated requests with mixed realm access.

Impact Analysis

An authenticated attacker could exploit this to link their assets to yours, potentially exposing your asset names through GET requests. With a 50% chance per attempt, they may persist these links and access sensitive information about your assets.

Compliance Impact

This vulnerability could lead to unauthorized access to asset data, potentially violating confidentiality requirements in GDPR and HIPAA. Exposure of asset names or linked data may result in non-compliance with data protection principles.

Mitigation Strategies

Upgrade to OpenRemote version 1.27.0 or later. Implement strict realm access validation for all endpoints. Restrict authenticated user permissions to prevent cross-tenant operations. Monitor for suspicious asset link modifications.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-67310. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart