HIGH 8.6 NVD
CVE-2026-124436
OpenRemote before 1.32.2 contains an improper authorization vulnerability that allows realm administrators to access and modify global resources by calling admi
OpenRemote before 1.32.2 contains an improper authorization vulnerability that allows realm administrators to access and modify global resources by calling admin endpoints lacking super administrator checks. Attackers can change the global keycloakUrl via /configuration/manager to redirect other realms' console authentication for credential phishing, inject CSS, replace map tiles, and delete logs.
References
- https://github.com/openremote/core/security/advisories/GHSA-gf33-2772-8gw3
- https://www.vulncheck.com/advisories/openremote-before-1.32.2-improper-authorization-allow
This high severity vulnerability with a CVSS score of 8.6 was published on 2026-11-08 via NVD.
vulnfeed aggregates 16937 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.