Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

3 records

Release: openremote core 1.31.0 Clear all filters
TI-2026-80204 CVE-2026-116186 · GHSA-pqvx-525p-jf88

Authorization bypass in OpenRemote core lets gateways alter other realms

Priority MEDIUM 45

OpenRemote core (openremote-manager) before 1.31.0 does not perform realm or gateway-descendant authorization on inbound edge gateway events and maps event asset IDs only through the reversible GatewayConnector.mapAssetI…

CVSS 4.0LOW 2.3 Network Low privileges No interaction EPSS 0.00205 Published 2026-10-25 Fixed in 1.31.0 CWE-639
TI-2026-80202 CVE-2026-116184 · GHSA-jrwj-grf5-9fv3

OpenRemote before 1.31.0 Cross-Realm Gateway Impersonation via Websocket

Priority LOW 11

OpenRemote before 1.31.0 contains an authorization bypass vulnerability that allows realm admins to impersonate gateways in other realms because GatewayService only checks the gateway ID, not the realm.

CVSS 4.0LOW 2.1 Network High privileges No interaction EPSS 0.0024 Published 2026-10-25 Fixed in 1.31.0 CWE-639