Description

An incorrect authorization check in the v2 Alarm REST API in OpenNMS Meridian and Horizon allows a low-privileged authenticated user (ROLE_REST) to acknowledge, escalate, or clear alarms recorded as an arbitrary username, and, when also assigned ROLE_READONLY, to modify alarm state despite the read-only restriction. A credential check that should restrict these operations is guarded by an inverted condition, so it never executes for a real (non-blank) username. This can potentially allow an attacker to compromise the integrity of alarm state and audit records. The solution is to upgrade to Meridian 2024.3.12, 2025.0.9 and Horizon 36.0.3 or newer. Meridian and Horizon installation instructions state that they are intended for installation within an organization's private networks and should not be directly accessible from the Internet.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-08-13T05:17:22.893Z",
  "pubdate": "2026-08-13T05:17:22.893Z",
  "executiveSummary": "An incorrect authorization check vulnerability exists within the v2 Alarm REST API of OpenNMS Meridian and Horizon. This security flaw allows a low-privileged authenticated user assigned the ROLE_REST role to manipulate alarm states, including acknowledging, escalating, or clearing alarms recorded as an arbitrary username. Furthermore, users assigned the ROLE_READONLY role can bypass these read-only restrictions to modify alarm states. The root cause stems from a credential verification check guarded by an inverted condition, causing the check to never execute for any non-blank username. The impact of this vulnerability involves a direct compromise of system integrity, specifically affecting the accuracy of alarm states and security audit records within the deployment. Exploitation requires authentication with low privileges, specifically the ROLE_REST role, and allows attackers to spoof actions on behalf of arbitrary users. Deployment guidelines dictate that affected products are intended for installation within private organizational networks and should not be directly exposed to the Internet, which serves as an environmental mitigating factor against external unauthenticated attacks.",
  "technicalDetails": "The vulnerability resides in the v2 Alarm REST API component of OpenNMS Meridian and Horizon. The core root cause of the flaw is an incorrect authorization and credential check logic error where the conditional statement governing the verification is inverted. Because of this inverted condition, the security check fails to execute whenever a real, non-blank username is provided during the API request processing. This logic flaw permits low-privileged authenticated users possessing the ROLE_REST role to perform administrative alarm lifecycle operations such as acknowledging, escalating, or clearing alarms while impersonating an arbitrary username.\nAdditionally, the authorization bypass interacts with the ROLE_READONLY role. Users who are assigned both ROLE_READONLY and ROLE_REST are normally restricted from modifying system states; however, due to the broken authorization check, these read-only limitations are bypassed, allowing unauthorized state modifications to alarms. The attack flow proceeds as follows: an authenticated attacker with low privileges crafts an HTTP request targeting the v2 Alarm REST API. The attacker includes parameters to modify an alarm state and specifies an arbitrary username in the request context. Because the credential check utilizes an inverted condition for non-blank usernames, the API endpoint bypasses the required security validation. Consequently, the application processes the request, executing the requested alarm status modification and recording the action under the specified arbitrary username.\nThe exploitation of this vulnerability directly undermines the integrity of the alarm management subsystem and invalidates compliance and security auditing trails by falsifying the user identity associated with critical event responses. Authentication is required to exploit this vulnerability, specifically a valid user session with at least ROLE_REST privileges. The network exposure is constrained by the architectural design of OpenNMS Meridian and Horizon, which are intended to operate within private internal networks rather than being directly exposed to the public Internet. Affected versions include OpenNMS Meridian and Horizon prior to the provided patches."
}