CVE-2026-73616

7.1 highEPSS 0.3%

High (7.1). EPSS 0.3% chance of exploitation in the next 30 days.

OpenRemote notification deletion endpoints fail to enforce realm boundaries, allowing any realm administrator to delete notifications belonging to other realms. Attackers with write:admin role in one realm can send DELETE requests to remove notifications from the master realm or other tenants without authorization checks.

Severity

CVSS 4.0

7.1 high

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

CVSS 3.1

6.5 medium

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

EPSS: 0.3% chance of exploitation in the next 30 days; higher than 24% of CVEs (scores of 2026-10-31)
CWE: CWE-639
Published: 2026-08-13
Modified: 2026-09-23
Record from: the NVD, synced 2026-10-19

References

https://github.com/openremote/openremote/security/advisories/GHSA-rc23-4mmm-4fx9
https://www.vulncheck.com/advisories/openremote-notification-delete-cross-realm-insecure-direct-object-reference
https://github.com/openremote/openremote/security/advisories/GHSA-rc23-4mmm-4fx9

Check your stack JSON