CVE-2026-49439CWE-862broken-access-control

CVE-2026-49439

Medium · published September 12, 2026

CVSS v3.1
4.3
EPSS
0%
Percentile
17.4
In the wild
Unconfirmed
What it is

OpenRemote is an open-source internet-of-things platform. Prior to version 1.24.1, the predicted datapoint write endpoint allows users with only `read:assets` privileges to write predicted datapoints. Version 1.24.1 fixes the issue.

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00264 · 17.4th percentile
Weakness
CWE-862 · Missing Authorization
Published
2026-09-12T01:17Z
References (2)
https://github.com/openremote/openremote/commit/583dbbfb96076ba099be8729ddf506acf9e48325 · [email protected]https://github.com/openremote/openremote/security/advisories/GHSA-xj53-j257-hxvg · [email protected]
EPSS history
Timeline
  • 13 SEP 03:22Z
    EPSS moved — → 0%
    epss
  • 11 SEP 20:44Z
    OpenRemote read-only asset users can write predicted datapoints
    cvelistv5