Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
OpenRemote before 1.25.0 contains an insecure direct object reference (IDOR) vulnerability in the bulk alarm deletion endpoint that allows authenticated users to permanently delete alarms belonging to other tenants by supplying arbitrary alarm IDs. The removeAlarms() method in AlarmResourceImpl.java omits realm-scoping validation in its JPA query, enabling any user with alarm-write permissions to enumerate sequential auto-increment alarm IDs and delete cross-tenant alarm records without authorization.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
CVE-2026-56784 Insecure Direct Object Reference in OpenRemote Manager Before 1.24.2 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-56784
Post summary
This short entry is a typical disclosure of CVE‑2026‑56784, noting the vulnerability type but providing no PoC, exploit, patch, or active exploitation details.