PT-2026-67290 · Unknown · Openremote

Manus-Use · CVE-2026-67310 · Published 2026-08-01 · Updated 2026-08-01

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions OpenRemote versions prior to 1.27.0

Description An insecure direct object reference exists in the setAssetLinks endpoint of AlarmResourceImpl. The realm access check only validates a single realm retrieved via realms.stream().findFirst() from a HashSet of realms in the request, instead of validating all realms. Due to the non-deterministic iteration order of HashSets, an authenticated attacker providing alarm-asset links from both their own realm and a victim realm can persist cross-tenant links. This allows the attacker to disclose victim asset names through GET requests on their own alarm.

Recommendations Update OpenRemote to version 1.27.0.

Exploit

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2026-67310

GHSA-Q2GM-FRX3-2QJR

Affected Products

Openremote

References · 5

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/67xxx/CVE-2026-67310.json · Exploit
• https://github.com/openremote/openremote/security/advisories/GHSA-q2gm-frx3-2qjr · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-67310 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-67310 · Security Note
• https://vulncheck.com/advisories/openremote-before-cross-tenant-idor-via-setassetlinks · Note