CVE-2026-73616

Description

OpenRemote notification deletion endpoints fail to enforce realm boundaries, allowing any realm administrator to delete notifications belonging to other realms. Attackers with write:admin role in one realm can send DELETE requests to remove notifications from the master realm or other tenants without authorization checks.

CVSS Vector

References

• https://github.com/openremote/openremote/security/advisories/GHSA-rc23-4mmm-4fx9
• https://www.vulncheck.com/advisories/openremote-notification-delete-cross-realm-insecure-direct-object-reference
• https://github.com/openremote/openremote/security/advisories/GHSA-rc23-4mmm-4fx9