Vulnerability · Published Aug 13, 2026 · Assigned by VulnCheck
CVE-2026-73616OpenRemote Notification Delete Cross-Realm Insecure Direct Object Reference
Medium 6.5
In plain English
A medium-severity authorization bypass via user-controlled key in openremote from openremote. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 24% of all known vulnerabilities).
Severity (CVSS 3.1)6.5Medium
Exploit odds (30 days)0.3%top 75.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
OpenRemote notification deletion endpoints fail to enforce realm boundaries, allowing any realm administrator to delete notifications belonging to other realms. Attackers with write:admin role in one realm can send DELETE requests to remove notifications from the master realm or other tenants without authorization checks.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| openremote | openremote | see references |
Weakness: CWE-639 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
References
- GitHub Security Advisory (GHSA-rc23-4mmm-4fx9) vendor-advisory
- VulnCheck Advisory: OpenRemote Notification Delete Cross-Realm Insecure Direct Object Reference third-party-advisory