CVE-2026-81679 in OpenRemote
Summary
by MITRE • 08/27/2026
OpenRemote versions before 1.28.0 contain a cross-realm information disclosure vulnerability in the Notification REST API that allows per-realm tenant administrators to read all tenants' sent notifications including message bodies. Attackers with read:admin credentials in one realm can submit a zero-parameter GET request to the notification endpoint to retrieve sensitive notification metadata and message content from all realms.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/27/2026
OpenRemote versions prior to 1.28.0 contain a critical cross-realm information disclosure vulnerability within its Notification REST API, which fundamentally undermines the multi-tenant isolation model designed to protect data privacy across different organizational domains. This flaw allows attackers who possess read:admin credentials in one specific realm to access sensitive notification metadata and message bodies belonging to all other tenants on the same instance. The core technical issue stems from a failure in server-side request validation, where the API endpoint does not adequately scope database queries or resource lookups to the authenticated user's tenant context. Consequently, when an attacker submits a zero-parameter GET request to the notification endpoint, the backend logic fails to filter results by realm ID, returning data associated with every registered tenant rather than restricting access to only those notifications relevant to the requesting administrator.
From a technical perspective, this vulnerability represents a classic case of broken object level authorization combined with insufficient input validation regarding context isolation. The absence of mandatory checks ensuring that retrieved resources belong to the current authentication domain allows for unauthorized cross-tenant data retrieval. This type of flaw is particularly dangerous in Software as a Service or multi-instance deployments where strict separation of duties and tenant boundaries are paramount for compliance and security. By exploiting this misconfiguration, an adversary can harvest sensitive communication content, potentially including personal identifiable information, internal business communications, or system alerts that were never intended to be visible outside their designated organizational boundary.
The operational impact of this vulnerability is severe, as it leads to a complete compromise of confidentiality across the entire platform infrastructure. Attackers with minimal privileges in any single tenant can achieve global data exposure without needing elevated permissions within other realms. This capability facilitates further reconnaissance and social engineering attacks by providing attackers with contextual information about other organizations' operations, security incidents, or internal communications. Furthermore, such widespread data leakage may violate regulatory requirements such as GDPR, HIPAA, or SOC2 standards regarding data segregation and access control, exposing the service provider to significant legal and reputational risks.
To mitigate this vulnerability, it is imperative that OpenRemote administrators immediately upgrade to version 1.28.0 or later, where these authorization checks have been corrected to enforce strict realm-scoped filtering on all notification API endpoints. In environments where immediate patching is not feasible, network-level controls such as Web Application Firewalls can be configured to restrict access to the Notification REST API based on IP reputation or rate limiting, although this does not fully resolve the underlying logic flaw. Additionally, organizations should review their identity and access management policies to ensure that read:admin credentials are granted only to trusted personnel within isolated administrative domains, minimizing the blast radius if a single tenant account is compromised.
This vulnerability aligns with CWE-284 Improper Access Control, specifically highlighting failures in enforcing scope restrictions for multi-tenant applications. It also maps to MITRE ATT&CK technique T1530 Data from Cloud Storage Object Misconfiguration and potentially T1078 Valid Accounts if the attacker leverages stolen credentials within a lower-privilege realm to pivot into broader data access. Understanding these mappings helps security teams prioritize remediation efforts and enhance monitoring for anomalous API calls that attempt to retrieve large volumes of cross-realm data, thereby strengthening the overall defense-in-depth posture against information disclosure attacks.