CVE-2026-73616

Name of the Vulnerable Software and Affected Versions OpenRemote (affected versions not specified)

Description Notification deletion endpoints fail to enforce realm boundaries, which allows a realm administrator to delete notifications belonging to other realms. An attacker possessing the write:admin role in one realm can send DELETE requests to remove notifications from the master realm or other tenants because authorization checks are not performed.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.