{"action":"Upgrade io.openremote:openremote-manager to 1.25.0 or later.","affected":[{"fixed":"1.25.0","introduced":"0"}],"component":"io.openremote:openremote-manager","cve_ids":["CVE-2026-56120","CVE-2026-56784"],"ecosystem":"Maven","exploited":false,"fixed_versions":["1.25.0"],"ghsa_id":"GHSA-h3m5-97jq-qjrf","id":"tcs_01M5N8ZGS688S8Z71WR97AP0DJ","modified_at":"2026-09-24T18:56:01.449004053Z","published_at":"2026-06-19T21:43:17Z","references":["https://osv.dev/vulnerability/GHSA-h3m5-97jq-qjrf","https://github.com/openremote/openremote/security/advisories/GHSA-h3m5-97jq-qjrf","https://nvd.nist.gov/vuln/detail/CVE-2026-56120","https://github.com/openremote/openremote/commit/9fad55e5a448c82772d241d395826e5d6fe1ce2d","https://github.com/openremote/openremote","https://github.com/openremote/openremote/blob/master/manager/src/main/java/org/openremote/manager/alarm/AlarmResourceImpl.java","https://github.com/openremote/openremote/blob/master/manager/src/main/java/org/openremote/manager/alarm/AlarmService.java","https://github.com/openremote/openremote/releases/tag/1.25.0","https://www.vulncheck.com/advisories/openremote-idor-via-bulk-alarm-deletion-endpoint"],"severity":{"label":"critical","score":9.6},"sources":[{"source":"osv","source_id":"GHSA-h3m5-97jq-qjrf","url":"https://osv.dev/vulnerability/GHSA-h3m5-97jq-qjrf"}],"summary":"OpenRemote Manager: removeAlarms cross-realm IDOR (bulk delete)"}