CVE-2026-124436

EUVD-2026-119564
OpenRemote before 1.32.2 contains an improper authorization vulnerability that allows realm administrators to access and modify global resources by calling admin endpoints lacking super administrator checks. Attackers can change the global keycloakUrl via /configuration/manager to redirect other realms' console authentication for credential phishing, inject CSS, replace map tiles, and delete logs.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
VulnCheckCNA
8 HIGH
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources (CNA/ADP records, vendor advisories, Enginsight analysis).
VendorProductVersionSource
openremoteopenremote
𝑥
< 1.32.2
CNA
Common Weakness Enumeration
References
https://github.com/openremote/core/security/advisories/GHSA-gf33-2772-8gw3
https://www.vulncheck.com/advisories/openremote-before-1.32.2-improper-authorization-allows-realm-admins-to-modify-global-resources