CVE-2026-56784

Name of the Vulnerable Software and Affected Versions OpenRemote versions prior to 1.25.0

Description An insecure direct object reference (IDOR) exists in the bulk alarm deletion endpoint. The removeAlarms() function in AlarmResourceImpl.java fails to perform realm-scoping validation in its JPA query. This allows authenticated users with alarm-write permissions to delete alarms belonging to other tenants by providing arbitrary, sequential auto-increment alarm IDs, leading to the permanent destruction of security and safety-critical alerts across different realms.

Recommendations Update to version 1.25.0 or later. As a temporary workaround, restrict access to the removeAlarms() function to only highly trusted administrators until the update is applied.