CVE-2026-56120

Name of the Vulnerable Software and Affected Versions OpenRemote versions prior to 1.25.0

Description An insecure direct object reference (IDOR) exists in the bulk alarm deletion endpoint. This occurs because the removeAlarms() function in AlarmResourceImpl.java fails to perform realm-scoping validation in its JPA query. Consequently, authenticated users with alarm-write permissions can delete alarm records belonging to other tenants by providing arbitrary, sequential auto-increment alarm IDs.

Recommendations Update to version 1.25.0 or later.