{"id":"CVE-2026-54641","summary":"OpenRemote: Cross-Realm User Information Disclosure in UserResourceImpl","details":"OpenRemote is an open-source internet-of-things platform. Prior to 1.24.2, the get, getUserClientRoles, and getUserRealmRoles methods in manager/src/main/java/org/openremote/manager/security/UserResourceImpl.java authorize callers with the read:admin role without confirming that the target UUID belongs to the requested and authenticated realm. A realm administrator can supply a user identifier from another tenant or the master realm and retrieve that user's profile, client roles, and realm roles, breaking tenant isolation and exposing privileged account information. This issue is fixed in version 1.24.2.","aliases":["GHSA-xqr9-4wvv-gvch"],"modified":"2026-10-15T07:07:22.667007890Z","published":"2026-10-13T16:07:55.725Z","database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-639"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/54xxx/CVE-2026-54641.json"},"references":[{"type":"WEB","url":"https://github.com/openremote/core/releases/tag/1.24.2"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/54xxx/CVE-2026-54641.json"},{"type":"ADVISORY","url":"https://github.com/openremote/core/security/advisories/GHSA-xqr9-4wvv-gvch"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-54641"},{"type":"FIX","url":"https://github.com/openremote/core/commit/de89b8d3af272d717bf297934c2cbc97243f08b7"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/openremote/core","events":[{"introduced":"0"},{"fixed":"de89b8d3af272d717bf297934c2cbc97243f08b7"},{"fixed":"c312ee8b2a7ccd0bda6a42b6ba26a5c7ab44a6d0"}],"database_specific":{"source":["AFFECTED_FIELD","REFERENCES"],"extracted_events":[{"introduced":"0"},{"fixed":"1.24.2"}]}}],"versions":["1.24.1","1.24.0","1.23.1","1.23.0","1.22.1","1.22.0","1.21.0","1.20.2","1.20.1","1.20.0","1.19.0","1.18.0","1.17.3","1.17.2","1.17.1","1.17.0","1.16.1","1.16.0","1.15.2","1.15.1","1.15.0","1.14.0","1.13.1","1.13.0","1.12.3","1.12.2","1.12.1","1.12.0","1.11.3","1.11.2","1.11.1","1.11.0","1.10.0","1.9.0","1.8.1","1.8.0","archive/console_loader","1.7.0","1.6.5","1.6.4","1.6.3","1.6.2","1.6.1","1.6.0","1.5.0","1.4.0","1.3.5","1.3.4","1.3.3","1.3.2","1.3.1","1.3.0","1.2.4","1.2.3","1.2.2","1.2.1","1.2.0"],"database_specific":{"vanir_signatures_modified":"2026-10-15T07:07:22Z","source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-54641.json","vanir_signatures":[{"source":"https://github.com/openremote/core/commit/de89b8d3af272d717bf297934c2cbc97243f08b7","target":{"file":"manager/src/main/java/org/openremote/manager/security/UserResourceImpl.java","function":"getClientRoles"},"deprecated":false,"digest":{"function_hash":"144349785051908380660016074980972587999","length":310},"id":"CVE-2026-54641-39cd28e4","signature_type":"Function","signature_version":"v1"},{"target":{"function":"getUserClientRoles","file":"manager/src/main/java/org/openremote/manager/security/UserResourceImpl.java"},"deprecated":false,"digest":{"function_hash":"54884423671043222201056446671642929554","length":624},"id":"CVE-2026-54641-3ba23294","signature_type":"Function","signature_version":"v1","source":"https://github.com/openremote/core/commit/de89b8d3af272d717bf297934c2cbc97243f08b7"},{"deprecated":false,"digest":{"length":581,"function_hash":"142640338877427028492643974306357966043"},"id":"CVE-2026-54641-5ec89f2a","signature_type":"Function","signature_version":"v1","source":"https://github.com/openremote/core/commit/de89b8d3af272d717bf297934c2cbc97243f08b7","target":{"file":"manager/src/main/java/org/openremote/manager/security/UserResourceImpl.java","function":"get"}},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/openremote/core/commit/de89b8d3af272d717bf297934c2cbc97243f08b7","target":{"file":"manager/src/main/java/org/openremote/manager/security/UserResourceImpl.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["243413356427520632702376708863921485567","17722570288952678359343572793407543200","286428338083395025081408205162074795702","41249762218559951010297642685541165659","89172605433049400933848681448523628733","211787387959855877360617920082327344191","295815934613923756357150500826083777753","217189849885132441457209587120191143301","2219336545230225898180305354493649624","11725842175530163699767863333596120398","302402124842717236931604854410746943071","241234118852315054192242568342933450137","74607695675452046284557952074977482669","33686431875029755265004533024720262008","48505658053525249572736180149870455035","135207808215025495334749264495227270104","1407862715195780365226089300849777944","27258265817877484422969751196755794209","5643305995387929053471408931735308678","257192060865304331918864282790636926142","293987087312908521551374287898352749266","283227844239843278347998969445515596769","198687105992509174912404686889106645747","328100077023422249062630255288243076060","306311190196474550503797810951228155958","89067760183907522163208498425117097608","177390312152534993602172718783444455112","172225794843122413526704209329505829268","321335730009282010258381530204754602727","55806599452538854688931715525332257615","94674672984322456323182181478905681922","164862921075731087127506007167627392741","153644674971569078143706255333388185556","42852281533059458153997095486486183217"]},"id":"CVE-2026-54641-6ceccc9e"},{"source":"https://github.com/openremote/core/commit/de89b8d3af272d717bf297934c2cbc97243f08b7","target":{"file":"manager/src/main/java/org/openremote/manager/security/UserResourceImpl.java","function":"getUserSessions"},"deprecated":false,"digest":{"function_hash":"300127443390667661426355099545134253532","length":694},"id":"CVE-2026-54641-8e917258","signature_type":"Function","signature_version":"v1"},{"source":"https://github.com/openremote/core/commit/de89b8d3af272d717bf297934c2cbc97243f08b7","target":{"file":"manager/src/main/java/org/openremote/manager/security/UserResourceImpl.java","function":"getUserRealmRoles"},"deprecated":false,"digest":{"function_hash":"22878827314649319690732224766675596245","length":590},"id":"CVE-2026-54641-c2a95988","signature_type":"Function","signature_version":"v1"}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N"}]}