Description (CNA)
OpenRemote notification deletion endpoints fail to enforce realm boundaries, allowing any realm administrator to delete notifications belonging to other realms. Attackers with write:admin role in one realm can send DELETE requests to remove notifications from the master realm or other tenants without authorization checks.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| openremote / openremote | affected |
CWE
CWE-639
References
- https://github.com/openremote/openremote/security/advisories/GHSA-rc23-4mmm-4fx9
- https://www.vulncheck.com/advisories/openremote-notification-delete-cross-realm-insecure-direct-object-reference
ADP enrichment
No English description supplied.