CVE-2026-81679 in OpenRemote

Resumen

por MITRE • 2026-08-27

OpenRemote versions before 1.28.0 contain a cross-realm information disclosure vulnerability in the Notification REST API that allows per-realm tenant administrators to read all tenants' sent notifications including message bodies. Attackers with read:admin credentials in one realm can submit a zero-parameter GET request to the notification endpoint to retrieve sensitive notification metadata and message content from all realms.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

• Responsable: VulnCheck
• Reservar: 2026-08-27
• Divulgación: 2026-08-27
• Moderación: aceptado
• Artículo: VDB-396247
• CPE: listo
• CWE: CWE-200 (confirmado)
• CVSS: 7.7 (CNA)
• EPSS: 0.00000
• KEV: no
• Actividades: muy bajo

Fuentes

• MITRE: https://www.cve.org/CVERecord?id=CVE-2026-81679
• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-81679
• CVE Details: https://www.cvedetails.com/cve/CVE-2026-81679/