Description
OpenRemote core (openremote-manager) before 1.31.0 does not perform realm or gateway-descendant authorization on inbound edge gateway events and maps event asset IDs only through the reversible GatewayConnector.mapAssetId transform. An attacker controlling a registered gateway can craft pre-image IDs in AttributeEvent or DELETE AssetEvent messages to overwrite attributes on, or delete, assets in any realm, breaking tenant isolation.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| openremote | core | < 1.31.0 | 1.31.0 |
References
- GitHub Security Advisory (GHSA-8pjc-wq2p-3xr4) vendor-advisory
- VulnCheck Advisory: OpenRemote before 1.31.0 Gateway Authorization Bypass via Reversible mapAssetId third-party-advisory