CVE-2026-54641

Name of the Vulnerable Software and Affected Versions OpenRemote versions prior to 1.24.2

Description An improper access control issue exists in the UserResourceImpl.java file. The get(), getUserClientRoles(), and getUserRealmRoles() methods authorize callers with the read:admin role without verifying if the target user's UUID belongs to the authenticated realm. This allows a realm administrator to bypass tenant isolation and retrieve the profile, client roles, and realm roles of users from other tenants or the master realm by providing the target user's identifier in the REST API path. This flaw enables cross-tenant user enumeration and reconnaissance of privilege levels.

Recommendations Update OpenRemote to version 1.24.2.