{"id":"CVE-2026-49439","summary":"OpenRemote read-only asset users can write predicted datapoints","details":"OpenRemote is an open-source internet-of-things platform. Prior to version 1.24.1, the predicted datapoint write endpoint allows users with only `read:assets` privileges to write predicted datapoints. Version 1.24.1 fixes the issue.","aliases":["GHSA-xj53-j257-hxvg"],"modified":"2026-09-12T14:02:08.265798Z","published":"2026-09-11T20:44:13.314Z","database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-862"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/49xxx/CVE-2026-49439.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/49xxx/CVE-2026-49439.json"},{"type":"FIX","url":"https://github.com/openremote/openremote/commit/583dbbfb96076ba099be8729ddf506acf9e48325"},{"type":"ADVISORY","url":"https://github.com/openremote/openremote/security/advisories/GHSA-xj53-j257-hxvg"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-49439"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/openremote/openremote","events":[{"introduced":"0"},{"fixed":"64b85d9df0f41206ff0b60fa18f35f3d63e6a138"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"fixed":"1.24.1"}],"source":"AFFECTED_FIELD"}}],"versions":["1.24.0","1.23.1","1.23.0","1.22.1","1.22.0","1.21.0","1.20.2","1.20.1","1.20.0","1.19.0","1.18.0","1.17.3","1.17.2","1.17.1","1.17.0","1.16.1","1.16.0","1.15.2","1.15.1","1.15.0","1.14.0","1.13.1","1.13.0","1.12.3","1.12.2","1.12.1","1.12.0","1.11.3","1.11.2","1.11.1","1.11.0","1.10.0","1.9.0","1.8.1","1.8.0","archive/console_loader","1.7.0","1.6.5","1.6.4","1.6.3","1.6.2","1.6.1","1.6.0","1.5.0","1.4.0","1.3.5","1.3.4","1.3.3","1.3.2","1.3.1","1.3.0","1.2.4","1.2.3","1.2.2","1.2.1","1.2.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-49439.json","vanir_signatures_modified":"2026-09-12T14:02:08Z","vanir_signatures":[{"source":"https://github.com/openremote/openremote/commit/64b85d9df0f41206ff0b60fa18f35f3d63e6a138","target":{"file":"manager/src/main/java/org/openremote/manager/rules/RulesFacts.java","function":"RulesFacts"},"deprecated":false,"digest":{"function_hash":"334591792211018393088307233705069557405","length":422},"id":"CVE-2026-49439-09d4c73c","signature_type":"Function","signature_version":"v1"},{"source":"https://github.com/openremote/openremote/commit/64b85d9df0f41206ff0b60fa18f35f3d63e6a138","target":{"file":"manager/src/main/java/org/openremote/manager/rules/RulesFacts.java"},"deprecated":false,"digest":{"line_hashes":["1446976280197360804534190544110448356","133360559487972588742996558125270962898","258929526640700512192908206626151065030","305722307430377172110066525424272557766"],"threshold":0.9},"id":"CVE-2026-49439-86c9c3b2","signature_type":"Line","signature_version":"v1"}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"}]}