CVE-2026-73616

EUVD-2026-57820
OpenRemote notification deletion endpoints fail to enforce realm boundaries, allowing any realm administrator to delete notifications belonging to other realms. Attackers with write:admin role in one realm can send DELETE requests to remove notifications from the master realm or other tenants without authorization checks.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
6.5 MEDIUM
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Common Weakness Enumeration
References
https://github.com/openremote/openremote/security/advisories/GHSA-rc23-4mmm-4fx9
https://www.vulncheck.com/advisories/openremote-notification-delete-cross-realm-insecure-direct-object-reference
https://github.com/openremote/openremote/security/advisories/GHSA-rc23-4mmm-4fx9