Description

OpenRemote notification deletion endpoints fail to enforce realm boundaries, allowing any realm administrator to delete notifications belonging to other realms. Attackers with write:admin role in one realm can send DELETE requests to remove notifications from the master realm or other tenants without authorization checks.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-13T12:17:26.480Z",
  "pubdate": "2026-08-13T12:17:26.480Z",
  "executiveSummary": "The OpenRemote notification management system suffers from an authorization flaw characterized by the failure to enforce strict realm boundaries during notification deletion operations. This security deficiency permits an authenticated adversary operating within a restricted tenant realm to successfully issue arbitrary deletion commands targeting resources residing in foreign realms, including the highly sensitive master realm. The primary impact of this vulnerability is a targeted denial of service and data integrity compromise via unauthorized destruction of notification records across multi-tenant deployments. The affected systems are OpenRemote installations featuring multi-tenancy configurations where notification endpoints process administrative API requests. The risk implications are severe for enterprise deployments relying on strict administrative isolation between distinct tenants. The required capabilities for an attacker include holding a valid write:admin role, but strictly within a foreign or untrusted realm. Exploitation requirements rely entirely on the ability to interact with the notification deletion endpoints of the target realm without requiring prior access to the targeted tenant's internal administrative infrastructure.",
  "technicalDetails": "The root cause of the vulnerability stems from inadequate access control validation within the notification deletion service logic of OpenRemote. Specifically, the application endpoints responsible for processing DELETE requests fail to cryptographically or logically verify whether the authenticated administrative principal executing the request possesses authorization scoping appropriate for the target notification's resident realm. Consequently, the authorization subsystem improperly relies on the presence of a generic administrative privilege rather than validating realm context ownership. The vulnerable component consists of the API routing and controller layers handling notification resource removal. The authentication requirement is bounded by the possession of a valid write:admin role in any isolated realm, while the privilege requirement is limited to tenant-level administrative status. Network exposure involves standard HTTP/HTTPS API interfaces exposed by the OpenRemote server handling administrative operations. The step-by-step attack flow initiates when an attacker authenticates and acquires a valid session token associated with the write:admin role within their designated compromised or attacker-controlled realm. The attacker then formulates a direct HTTP DELETE request targeted at the notification management endpoint, specifying resource identifiers associated with notifications belonging to a different tenant or the master realm. Because the backend service logic fails to cross-reference the session realm identifier with the target resource's realm ownership, the request is processed successfully. The payload behavior involves standard HTTP protocol semantics targeting specific resource URIs, bypassing logical tenant segregation. The post-exploitation impact includes unauthorized data destruction, operational disruption, and the potential undermining of multi-tenant trust boundaries where administrative isolation is legally or operationally mandated."
}