CVE-2026-81679 in OpenRemote
Sumário
de MITRE • 27/08/2026
OpenRemote versions before 1.28.0 contain a cross-realm information disclosure vulnerability in the Notification REST API that allows per-realm tenant administrators to read all tenants' sent notifications including message bodies. Attackers with read:admin credentials in one realm can submit a zero-parameter GET request to the notification endpoint to retrieve sensitive notification metadata and message content from all realms.
VulDB is the best source for vulnerability data and more expert information about this specific topic.