CyberRota Analysis
AI-GeneratedOpenRemote versions up to 1.26.2 are vulnerable due to an insecure direct object reference in the setAssetLinks endpoint, allowing authenticated attackers to exploit cross-tenant access and potentially disclose sensitive asset information from victim realms. The non-deterministic nature of HashSet iteration means that attackers can persistently link their own alarms to victim assets with about a 50% success rate per request. Organizations using affected versions should prioritize updating to version 1.27.0 to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
OpenRemote (org.openremote:openremote) versions <= 1.26.2 contain an insecure direct object reference vulnerability in the setAssetLinks endpoint of AlarmResourceImpl. The realm access check validates only a single realm obtained via realms.stream().findFirst() on a HashSet of realms from the request, rather than all realms. Because HashSet iteration order is non-deterministic, an authenticated attacker who includes alarm-asset links from both their own realm and a victim realm can, with roughly 50% probability per request (retryable), persist cross-tenant links and disclose victim asset names (returned via @Formula fields) through GET requests on the attacker's own alarm. Fixed in 1.27.0.