Description

OpenRemote is an open-source internet-of-things platform. Prior to version 1.24.1, the predicted datapoint write endpoint allows users with only `read:assets` privileges to write predicted datapoints. Version 1.24.1 fixes the issue.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-09-11T21:17:10.370Z",
  "pubdate": "2026-09-11T21:17:10.370Z",
  "executiveSummary": "OpenRemote versions prior to 1.24.1 are susceptible to a broken access control vulnerability within the predicted datapoint write endpoint. This flaw permits unauthorized write operations by users possessing restricted read-only privileges, specifically those with 'read:assets' scopes. The vulnerability allows an authenticated attacker to bypass intended authorization constraints and perform unauthorized modifications to data points within the IoT ecosystem. The risk implications include the potential for data integrity compromise, manipulation of IoT device logic, and the injection of fraudulent sensor readings. Exploitation requires authenticated access to the platform, meaning the attack is limited to users already present within the system's identity management framework but operating outside their assigned security policy boundaries. This issue represents a significant failure in the principle of least privilege, as the application fails to validate the authorization scope of the requesting user against the requested state-changing action. Remediation is achieved by upgrading to version 1.24.1, which corrects the improper authorization checks on the affected endpoint.",
  "technicalDetails": "The vulnerability resides in the authorization logic governing the interaction with the predicted datapoint write endpoint in OpenRemote versions prior to 1.24.1. The root cause of this flaw is the insufficient implementation of access control checks during the dispatch of requests to the specific API controller responsible for data ingestion and prediction updates. While the system correctly identifies the user's identity, the backend validation mechanism fails to verify whether the provided security token includes the necessary 'write' scopes for the target resource.\nSpecifically, the application erroneously evaluates the authorization context, allowing requests that should be restricted to read-only operations to proceed to the data persistence layer. An attacker with 'read:assets' privileges—typically intended for monitoring and viewing existing asset status—can leverage this misconfiguration to invoke the write functionality. By crafting a valid HTTP request directed at the predicted datapoint endpoint, an authenticated attacker can bypass the intended permission model. The application processes the payload, treating the request as a legitimate state-change operation despite the lack of corresponding write privileges in the attacker's security principal.\nThe attack flow involves the following steps: 1) The attacker authenticates to the OpenRemote platform using credentials associated with an account holding only the 'read:assets' permission. 2) The attacker identifies the endpoint responsible for writing predicted datapoints. 3) The attacker submits an unauthorized POST or PUT request containing the targeted datapoint data. 4) Due to the lack of granular privilege enforcement, the backend logic accepts the request and updates the internal data structures.\nThe impact of this vulnerability is significant, as it permits unauthorized users to overwrite existing datapoints or inject artificial data. In an IoT context, this could result in skewed analytics, the triggering of faulty automated responses, or the masking of malicious activity by injecting false telemetry. The vulnerability highlights a failure in the application's security middleware to enforce strict role-based access control (RBAC) at the service level, necessitating the explicit verification of scopes for every sensitive API operation."
}