SEPTEMBER 14, 2026
Live Feed
Back to database
Case File

CVE-2026-49439

MEDIUM · CVSS 4.3 EPSS 0.16% Public Exploit

Source: NVD + CISA KEV + EPSS · Published 2026-09-11 · Last synced 2026-09-14

CyberRota Analysis

AI-Generated

The OpenRemote IoT platform prior to version 1.24.1 has a vulnerability that permits users with only `read:assets` privileges to write predicted datapoints, potentially leading to unauthorized data manipulation. Organizations utilizing this platform should prioritize upgrading to version 1.24.1 to mitigate the risk of data integrity issues and unauthorized access.

Public Exploit Signal

A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.

GitHub PoC Links
github.com ↗ github.com ↗

Note: these links are listed for security research and verification purposes only.

CVE
CVE-2026-49439
Severity
MEDIUM
CVSS
4.3
EPSS
0.16%

Original NVD Description

OpenRemote is an open-source internet-of-things platform. Prior to version 1.24.1, the predicted datapoint write endpoint allows users with only `read:assets` privileges to write predicted datapoints. Version 1.24.1 fixes the issue.