Description
OpenRemote versions before 1.28.0 contain a cross-realm information disclosure vulnerability in the Notification REST API that allows per-realm tenant administrators to read all tenants' sent notifications including message bodies. Attackers with read:admin credentials in one realm can submit a zero-parameter GET request to the notification endpoint to retrieve sensitive notification metadata and message content from all realms.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| openremote | openremote | < 1.28.0 | 1.28.0 |
References
- GitHub Security Advisory (GHSA-6ff4-4frc-r287) vendor-advisory
- VulnCheck Advisory: OpenRemote before 1.28.0 Cross-Realm Information Disclosure via Notification API third-party-advisory