CVE-2026-56784

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-56784
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-56784.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-56784
Aliases
Published
2026-06-23T12:13:07.594Z
Modified
2026-08-12T03:51:24.731676892Z
Severity
  • 8.6 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
OpenRemote < 1.25.0 IDOR via Bulk Alarm Deletion Endpoint
Details

OpenRemote before 1.25.0 contains an insecure direct object reference (IDOR) vulnerability in the bulk alarm deletion endpoint that allows authenticated users to permanently delete alarms belonging to other tenants by supplying arbitrary alarm IDs. The removeAlarms() method in AlarmResourceImpl.java omits realm-scoping validation in its JPA query, enabling any user with alarm-write permissions to enumerate sequential auto-increment alarm IDs and delete cross-tenant alarm records without authorization.

Database specific 
{
    "cwe_ids": [
        "CWE-639"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/56xxx/CVE-2026-56784.json",
    "cna_assigner": "VulnCheck"
}
References

Affected packages

Git / github.com/openremote/openremote

Affected ranges

Type
GIT
Repo
https://github.com/openremote/openremote
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
0ed159ba423de28896ab77a07427cdc32ed0712a
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "1.25.0"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "DESCRIPTION"
    ]
}

Affected versions

1.*
1.10.0
1.11.0
1.11.1
1.11.2
1.11.3
1.12.0
1.12.1
1.12.2
1.12.3
1.13.0
1.13.1
1.14.0
1.15.0
1.15.1
1.15.2
1.16.0
1.16.1
1.17.0
1.17.1
1.17.2
1.17.3
1.18.0
1.19.0
1.2.0
1.2.1
1.2.2
1.2.3
1.2.4
1.20.0
1.20.1
1.20.2
1.21.0
1.22.0
1.22.1
1.23.0
1.23.1
1.24.0
1.24.1
1.24.2
1.3.0
1.3.1
1.3.2
1.3.3
1.3.4
1.3.5
1.4.0
1.5.0
1.6.0
1.6.1
1.6.2
1.6.3
1.6.4
1.6.5
1.7.0
1.8.0
1.8.1
1.9.0
Other
archive/console_loader

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-56784.json"