CVE-2026-56120: OpenRemote Manager: removeAlarms cross-realm IDOR (bulk delete)

Should you act?

Critical, preconditions apply

Severe if exploited, but exploitation needs conditions that may not apply to you. This signal is computed from CISA KEV, EPSS and CVSS data; it is not an editorial verdict.

• No confirmed exploitation. It is not in CISA’s KEV catalog. That can change quickly after a public write-up; re-check if you are affected.
• Needs an account (low (any account)). Exposure depends on who can log in.
• Only applies if your dependency tree includes io.openremote:openremote-manager (Maven) < 1.25.0, fixed in 1.25.0. Check your lockfile, including transitive dependencies.

What it is

From the GitHub advisory

Summary OpenRemote Manager is vulnerable to a cross-tenant Insecure Direct Object Reference (IDOR) in the bulk alarm deletion endpoint. An authenticated user in any realm can delete alarms belonging to other realms (tenants) by supplying arbitrary alarm IDs. The vulnerability exists because the bulk removeAlarms() method only verifies that the caller's own realm is active and accessible, but never checks whether the targeted alarm IDs belong to the caller's realm before deleting them.

This allows any user with alarm write permissions in their own realm to permanently destroy alarm records — including safety-critical and security alerts — belonging to any other tenant on the same OpenRemote installation.

------------------------------------------

[Additional Information] The singular removeAlarm() method correctly validates that the target alarm's realm matches the caller's access:

// CORRECT (singular): SentAlarm alarm = alarmService.getAlarm(alarmId); if (!isRealmActiveAndAccessible(alarm.getRealm())) { throw new ForbiddenException(...); }

Weakness type: CWE-639.

Product: io.openremote:openremote-manager (Maven) · Assigned by: VulnCheck · Published: 2026-06-23

Affected and fixed versions

Severity scores

• Attack vector: network (remotely reachable)
• Attack complexity: low
• Privileges required: low (any account)
• User interaction: none
• Scope: changed (can affect other components)

CVSS measures how bad a flaw is if exploited, not how likely exploitation is. Read it next to the exploitation data below.

Exploitation and urgency

• CISA KEV: not listed (no confirmed in-the-wild exploitation known to CISA).

Timeline

• 2026-06-19 — GitHub-reviewed advisory GHSA-h3m5-97jq-qjrf published (critical)
• 2026-06-23 — CVE record last updated
• 2026-06-23 — CVE record published by VulnCheck

Sources and references

Original sources first. Version and fix details should always be confirmed against the vendor or project advisory.

Vulnerability records

1. GitHub Advisory GHSA-h3m5-97jq-qjrf github.com
2. CVE.org record CVE-2026-56120 cve.org
3. NVD entry CVE-2026-56120 nvd.nist.gov

Other references from the CVE record and advisory

1. github.com github.com
2. github.com github.com
3. github.com github.com
4. github.com github.com
5. github.com github.com
6. vulncheck.com vulncheck.com

Critical Maven advisories · Today’s Security Digest