CVE-2026-49439

EUVD-2026-76694
OpenRemote is an open-source internet-of-things platform. Prior to version 1.24.1, the predicted datapoint write endpoint allows users with only `read:assets` privileges to write predicted datapoints. Version 1.24.1 fixes the issue.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
GitHub_MCNA
4.3 MEDIUM
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 5.31%
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
VendorProductVersionSource
openremoteopenremote
𝑥
< 1.24.1
CNA
Common Weakness Enumeration
References
https://github.com/openremote/openremote/commit/583dbbfb96076ba099be8729ddf506acf9e48325
https://github.com/openremote/openremote/security/advisories/GHSA-xj53-j257-hxvg