{"action":"Upgrade io.openremote:openremote-manager to 1.24.1 or later.","affected":[{"fixed":"1.24.1","introduced":"0"}],"component":"io.openremote:openremote-manager","cve_ids":["CVE-2026-49439"],"ecosystem":"Maven","epss":0.00264,"exploited":false,"fixed_versions":["1.24.1"],"ghsa_id":"GHSA-xj53-j257-hxvg","id":"tcs_01M5N9JEZXPBADBMBW3K6XZVW9","modified_at":"2026-07-06T17:11:31.089802Z","published_at":"2026-07-06T16:52:35Z","references":["https://osv.dev/vulnerability/GHSA-xj53-j257-hxvg","https://github.com/openremote/openremote/security/advisories/GHSA-xj53-j257-hxvg","https://github.com/openremote/openremote/commit/583dbbfb96076ba099be8729ddf506acf9e48325","https://github.com/openremote/openremote"],"severity":{"label":"medium","score":4.3},"sources":[{"source":"osv","source_id":"GHSA-xj53-j257-hxvg","url":"https://osv.dev/vulnerability/GHSA-xj53-j257-hxvg"}],"summary":"OpenRemote read-only asset users can write predicted datapoints"}