CVE-2026-67310: openremote before 1.27.0 Cross-Tenant IDOR via setAssetLinks
OpenRemote (org.openremote:openremote) versions <= 1.26.2 contain an insecure direct object reference vulnerability in the setAssetLinks endpoint of AlarmResourceImpl. The realm access check validates only a single realm obtained via realms.stream().findFirst() on a HashSet of realms from the request, rather than all realms. Because HashSet iteration order is non-deterministic, an authenticated attacker who includes alarm-asset links from both their own realm and a victim realm can, with roughly 50% probability per request (retryable), persist cross-tenant links and disclose victim asset names (returned via @Formula fields) through GET requests on the attacker's own alarm. Fixed in 1.27.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
org.openremote:openremoteto a version that resolves this vulnerability.Fixed in 1.27.0 - Compensating control
If upgrading to 1.27.0 is not immediately possible, limit access to the setAssetLinks functionality/endpoint in AlarmResourceImpl so authenticated users cannot call it across tenants/realms (e.g., restrict via authorization rules and/or network/ACL controls that enforce tenant isolation).