CVE-2026-81679 — OpenRemote before 1.28.0 Cross-Realm Information Disclosure via Notification API
OpenRemote versions before 1.28.0 contain a cross-realm information disclosure vulnerability in the Notification REST API that allows per-realm tenant administrators to read all…
Published: 2026-08-27 · CVSS: 8.3 · CVSS 4.0
OpenRemote versions before 1.28.0 contain a cross-realm information disclosure vulnerability in the Notification REST API that allows per-realm tenant administrators to read all tenants' sent notifications including message bodies. Attackers with read:admin credentials in one realm can submit a zero-parameter GET request to the notification endpoint to retrieve sensitive notification metadata and message content from all realms.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7