Maven/io.openremote:openremote-manager CVE-2026-56120, CVE-2026-56784: critical 9.6
OpenRemote Manager: removeAlarms cross-realm IDOR (bulk delete)
Action: Upgrade io.openremote:openremote-manager to 1.25.0 or later.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 1.25.0 | - |
Fixed versions
| 1.25.0 |
Sources
- osv: GHSA-h3m5-97jq-qjrf
- https://github.com/openremote/openremote/security/advisories/GHSA-h3m5-97jq-qjrf
- https://nvd.nist.gov/vuln/detail/CVE-2026-56120
- https://github.com/openremote/openremote/commit/9fad55e5a448c82772d241d395826e5d6fe1ce2d
- https://github.com/openremote/openremote
- https://github.com/openremote/openremote/blob/master/manager/src/main/java/org/openremote/manager/alarm/AlarmResourceImpl.java
- https://github.com/openremote/openremote/blob/master/manager/src/main/java/org/openremote/manager/alarm/AlarmService.java
- https://github.com/openremote/openremote/releases/tag/1.25.0
- https://www.vulncheck.com/advisories/openremote-idor-via-bulk-alarm-deletion-endpoint
CVE-2026-56120, CVE-2026-56784 · published · modified · JSON