CVE-2026-73616CWE-639

CVE-2026-73616

Medium · published August 13, 2026

CVSS v3.1
6.5
EPSS
0%
Percentile
11.7
In the wild
Unconfirmed
What it is

OpenRemote notification deletion endpoints fail to enforce realm boundaries, allowing any realm administrator to delete notifications belonging to other realms. Attackers with write:admin role in one realm can send DELETE requests to remove notifications from the master realm or other tenants without authorization checks.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00219 · 11.7th percentile
Weakness
CWE-639 · Authorization Bypass Through User-Controlled Key
Published
2026-08-13T16:17Z
References (3)
https://github.com/openremote/openremote/security/advisories/GHSA-rc23-4mmm-4fx9 · [email protected]https://www.vulncheck.com/advisories/openremote-notification-delete-cross-realm-insecure-direct-object-reference · [email protected]https://github.com/openremote/openremote/security/advisories/GHSA-rc23-4mmm-4fx9 · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 13 AUG 11:28Z
    OpenRemote Notification Delete Cross-Realm Insecure Direct Object Reference
    cvelistv5