Tulkin Urinbaev

**Name of the Vulnerable Software and Affected Versions** OpenRemote versions prior to 1.25.0 **Description** An insecure direct object reference (IDOR) exists in the bulk alarm deletion endpoint. This occurs because the `removeAlarms()` function in `AlarmResourceImpl.java` fails to perform realm-scoping validation in its JPA query. Consequently, authenticated users with alarm-write permissions can delete alarm records belonging to other tenants by providing arbitrary, sequential auto-increment alarm IDs. **Recommendations** Update to version 1.25.0 or later.

**Name of the Vulnerable Software and Affected Versions** OpenRemote versions prior to 1.25.0 **Description** An insecure direct object reference (IDOR) exists in the bulk alarm deletion endpoint. The `removeAlarms()` function in `AlarmResourceImpl.java` fails to perform realm-scoping validation in its JPA query. This allows authenticated users with alarm-write permissions to delete alarms belonging to other tenants by providing arbitrary, sequential auto-increment alarm IDs, leading to the permanent destruction of security and safety-critical alerts across different realms. **Recommendations** Update to version 1.25.0 or later. As a temporary workaround, restrict access to the `removeAlarms()` function to only highly trusted administrators until the update is applied.