CVE-2026-81679

Received Received - Intake

Cross-Realm Information Disclosure in OpenRemote

Publication date: 2026-08-27

Last updated on: 2026-08-28

Assigner: VulnCheck

Description

OpenRemote versions before 1.28.0 contain a cross-realm information disclosure vulnerability in the Notification REST API that allows per-realm tenant administrators to read all tenants' sent notifications including message bodies. Attackers with read:admin credentials in one realm can submit a zero-parameter GET request to the notification endpoint to retrieve sensitive notification metadata and message content from all realms.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-27

Last Modified

2026-08-28

Generated

2026-09-17

AI Q&A

2026-08-27

EPSS Evaluated

2026-09-15

NVD

CVE-2026-81679

EUVD

EUVD-2026-67035

Affected Vendors & Products

Vendor	Product	Version / Range
openremote	openremote	to 1.28.0 (exc)
openremote	openremote	to 1.27.1 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-200	The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

Executive Summary

This is a cross-realm information disclosure vulnerability in OpenRemote versions before 1.28.0. It allows tenant administrators with read:admin credentials in one realm to access all tenants' sent notifications, including message bodies and metadata, by sending a GET request to the notification endpoint without parameters.

Detection Guidance

Check OpenRemote versions before 1.28.0 by running commands like 'docker ps' or examining installed packages to identify vulnerable instances. Monitor network traffic for unauthorized GET requests to the Notification REST API endpoint without parameters.

Impact Analysis

Attackers with read:admin access in one realm could steal sensitive data like messages, user IDs, asset IDs, and timestamps from all other realms. This could lead to data breaches, unauthorized access to confidential information, and potential misuse of exposed data.

Compliance Impact

This vulnerability likely violates GDPR and HIPAA due to unauthorized access to sensitive personal data. GDPR requires protecting personal data, while HIPAA mandates safeguarding protected health information. A breach could result in legal penalties and reputational damage.

Mitigation Strategies

Upgrade OpenRemote to version 1.28.0 or later immediately. If upgrading is not possible, restrict access to the Notification REST API endpoint and ensure proper realm-based access controls are enforced.

Hi! I’m here to help you understand CVE-2026-81679. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70