OpenRemote Notification Deletion Authorization Bypass

Executive Summary

CVE-2026-73616 is an Insecure Direct Object Reference (IDOR) vulnerability in OpenRemote's notification deletion endpoints. Realm administrators with the write:admin role can delete notifications belonging to other realms, including the master realm or other tenants, without proper authorization checks. The endpoints fail to enforce realm boundaries, allowing unauthorized cross-realm data deletion.

Useful 0 Not Useful 0

Detection Guidance

Check OpenRemote server logs for unauthorized DELETE requests to notification endpoints. Look for requests to /api/notification/removeNotifications or /api/notification/removeNotification with mismatched realm IDs. Use network monitoring tools to inspect HTTP DELETE requests targeting these endpoints from non-master realms.

Useful 0 Not Useful 0

Impact Analysis

An attacker with admin privileges in one realm could delete critical notifications in other realms, such as safety alerts, audit trails, or operational messages. This could lead to operational disruptions, hidden incidents, or loss of important records without detection.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to non-compliance with GDPR or HIPAA by enabling unauthorized deletion of audit trails or operational records. Loss of such data may violate record-keeping requirements, data integrity principles, or breach notification obligations under these regulations.

Useful 0 Not Useful 0

Mitigation Strategies

Apply the official patch from OpenRemote that adds realm authorization checks to delete endpoints. Temporarily restrict write:admin role permissions to prevent cross-realm access. Monitor notification deletion logs for suspicious activity and implement network-level controls to block unauthorized DELETE requests.

Useful 0 Not Useful 0