{"vulnerability": "ghsa-h3m5-97jq-qjrf", "sightings": [{"uuid": "574605a6-8eeb-48f9-af9c-4b2f4c3f2838", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-h3m5-97jq-qjrf", "type": "seen", "source": "https://gist.github.com/alon710/2f8edd2e7aeda928380e8cf2e8c29eb1", "content": "# GHSA-H3M5-97JQ-QJRF: GHSA-H3M5-97JQ-QJRF: Insecure Direct Object Reference (IDOR) Cross-Realm Bulk Alarm Deletion in OpenRemote Manager\n\n> **CVSS Score:** 9.6\n> **Published:** 2026-06-19\n> **Full Report:** https://cvereports.com/reports/GHSA-H3M5-97JQ-QJRF\n\n## Summary\nAn Insecure Direct Object Reference (IDOR) and missing authorization flaw in OpenRemote Manager allows an authenticated, low-privilege multi-tenant user to execute cross-realm bulk alarm deletion, resulting in permanent destruction of safety-critical alarms belonging to other tenants.\n\n## TL;DR\nA missing authorization check in OpenRemote Manager's bulk delete endpoint allows low-privilege tenant users to bypass multi-tenancy boundaries and delete safety-critical alarms belonging to any other realm by sending a list of auto-incremented database IDs.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-639 / CWE-862\n- **Attack Vector**: Network (AV:N)\n- **CVSS**: 9.6 (Critical)\n- **Impact**: Integrity (High), Availability (High)\n- **Exploit Status**: Proof-of-Concept\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- OpenRemote Manager\n- **openremote-manager**: < 1.24.2 (Fixed in: `1.24.2`)\n\n## Mitigation\n\n- Upgrade OpenRemote Manager dependency to version 1.24.2 or later\n- Enforce rate limiting on API deletion endpoints\n- Restrict the maximum payload size of JSON arrays in DELETE requests\n\n**Remediation Steps:**\n1. Identify the current OpenRemote version in pom.xml\n2. Update the io.openremote:openremote-manager version dependency to 1.24.2\n3. Rebuild and redeploy the OpenRemote container images\n4. Verify the mitigation using the provided integration tests\n\n## References\n\n- [GHSA-H3M5-97JQ-QJRF: OpenRemote Manager removeAlarms cross-realm IDOR](https://github.com/openremote/openremote/security/advisories/GHSA-h3m5-97jq-qjrf)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/GHSA-H3M5-97JQ-QJRF) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-06-22T03:42:22.000000Z"}]}