CVE-2026-49439

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-49439

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-49439.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-49439

Aliases

GHSA-xj53-j257-hxvg

Published

2026-09-11T20:44:13Z

Modified

2026-09-25T08:27:28Z

Severity

4.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N CVSS Calculator

Summary

OpenRemote read-only asset users can write predicted datapoints

Details

OpenRemote is an open-source internet-of-things platform. Prior to version 1.24.1, the predicted datapoint write endpoint allows users with only read:assets privileges to write predicted datapoints. Version 1.24.1 fixes the issue.

Database specific

{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-862"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/49xxx/CVE-2026-49439.json"
}

References

Affected packages

Git / github.com/openremote/openremote

Affected ranges

Type

GIT

Repo

https://github.com/openremote/openremote

Events

Introduced

Fixed

583dbbfb96076ba099be8729ddf506acf9e48325

Database specific

Show details

{
    "extracted_events":  [
        {
            "introduced":  "0"
        },
        {
            "fixed":  "1.24.1"
        }
    ],
    "source":  [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

1.*

1.10.0

1.11.0

1.11.1

1.11.2

1.11.3

1.12.0

1.12.1

1.12.2

1.12.3

1.13.0

1.13.1

1.14.0

1.15.0

1.15.1

1.15.2

1.16.0

1.16.1

1.17.0

1.17.1

1.17.2

1.17.3

1.18.0

1.19.0

1.2.0

1.2.1

1.2.2

1.2.3

1.2.4

1.20.0

1.20.1

1.20.2

1.21.0

1.22.0

1.22.1

1.23.0

1.23.1

1.24.0

1.3.0

1.3.1

1.3.2

1.3.3

1.3.4

1.3.5

1.4.0

1.5.0

1.6.0

1.6.1

1.6.2

1.6.3

1.6.4

1.6.5

1.7.0

1.8.0

1.8.1

1.9.0

Other

archive/console_loader

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-49439.json"

vanir_signatures

[
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "329754469867997202724810898888450783013",
            "length":  1684
        },
        "id":  "CVE-2026-49439-65805b51",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/openremote/openremote/commit/583dbbfb96076ba099be8729ddf506acf9e48325",
        "target":  {
            "file":  "manager/src/main/java/org/openremote/manager/datapoint/AssetPredictedDatapointResourceImpl.java",
            "function":  "getPredictedDatapoints"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "70483378994703025257457614607475931328",
                "56193910732542726022823990807134868181",
                "3073176473073308872680184546529400754",
                "90271692237952451248180441024059997416",
                "290678778966337697270978952609997716989",
                "298161842464461678475713825859395769490",
                "9595616879423640502684280708840759609",
                "287794521642953445736871886862105250983",
                "206926463964777844861621784629294404056",
                "105818522104317793927567418163944003003",
                "106157390877964554375036318789762312521",
                "246644954976294439341453239573560177215",
                "42881784268792133321854865383423649921",
                "70483378994703025257457614607475931328",
                "56193910732542726022823990807134868181",
                "3073176473073308872680184546529400754",
                "90271692237952451248180441024059997416",
                "290678778966337697270978952609997716989",
                "287794521642953445736871886862105250983",
                "206926463964777844861621784629294404056",
                "105818522104317793927567418163944003003",
                "325229185334672383014021636094517508055",
                "215947665915565579838060878325765187235",
                "23279356832360979143491222247400077842",
                "237731407151970332165356632410600455296",
                "184475441644271722372957127983036449177",
                "103961923457900487698406855594655461217",
                "288937427853309507644404515579490154336",
                "33511128353554537844160585563637158111",
                "220779463977855092067204554198051229017"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-49439-7c08ef7c",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/openremote/openremote/commit/583dbbfb96076ba099be8729ddf506acf9e48325",
        "target":  {
            "file":  "manager/src/main/java/org/openremote/manager/datapoint/AssetPredictedDatapointResourceImpl.java"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "38913832228309263827539530913461871357",
            "length":  1661
        },
        "id":  "CVE-2026-49439-ac414894",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/openremote/openremote/commit/583dbbfb96076ba099be8729ddf506acf9e48325",
        "target":  {
            "file":  "manager/src/main/java/org/openremote/manager/datapoint/AssetPredictedDatapointResourceImpl.java",
            "function":  "writePredictedDatapoints"
        }
    }
]

vanir_signatures_modified

"2026-09-25T08:27:28Z"