CVE-2026-67310

Katalog CVE

CVSS 5.4 · Medium EPSS 0,24%

Kerentanan Incorrect Authorization. Skor CVSS 3.1 5.4 (Medium) menurut vulncheck.com.

Deskripsi (NVD)

OpenRemote (org.openremote:openremote) versions <= 1.26.2 contain an insecure direct object reference vulnerability in the setAssetLinks endpoint of AlarmResourceImpl. The realm access check validates only a single realm obtained via realms.stream().findFirst() on a HashSet of realms from the request, rather than all realms. Because HashSet iteration order is non-deterministic, an authenticated attacker who includes alarm-asset links from both their own realm and a victim realm can, with roughly 50% probability per request (retryable), persist cross-tenant links and disclose victim asset names (returned via @Formula fields) through GET requests on the attacker's own alarm. Fixed in 1.27.0.

Rincian

Terbit di NVD

1 Agustus 2026

Terakhir diubah

8 Oktober 2026

Status NVD

Deferred

CVSS 3.1

5.4 (Medium), sumber vulncheck.com
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-863: Incorrect Authorization

EPSS (30 hari)

0,24% peluang dieksploitasi; lebih tinggi dari 13,8% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://github.com/openremote/openremote/security/advisories/GHSA-q2gm-frx3-2qjr
• https://www.vulncheck.com/advisories/openremote-before-cross-tenant-idor-via-setassetlinks