Cross-Realm Information Disclosure in OpenRemote Notification API

OpenRemote versions prior to 1.28.0 are susceptible to a cross-realm information disclosure vulnerability (CVE-2026-81679) within the Notification REST API. This vulnerability stems from improper authorization checks, enabling a tenant administrator with read:admin credentials in one realm to view notification metadata and message bodies belonging to other tenants. By submitting a specifically crafted GET request to the notification endpoint, an attacker can bypass intended realm isolation. This issue is particularly critical for multi-tenant environments where strict data separation is required for compliance and security. The vulnerability allows an attacker to exfiltrate notification content from across the entire instance, potentially leading to the exposure of sensitive configuration details, PII, or internal credentials transmitted via system notifications.

Impact

Successful exploitation results in the unauthorized collection of cross-tenant notification data. This impacts multi-tenant deployments by breaking tenant isolation boundaries, potentially exposing sensitive message content and metadata to unauthorized administrators. The number of affected deployments is tied to the adoption of OpenRemote versions 1.27.x and earlier in multi-realm configurations.

Recommendation

• Upgrade all instances of OpenRemote to version 1.28.0 or later to apply the necessary authorization controls.
• Audit logs for administrative access to the notification REST API endpoint, specifically monitoring for frequent GET requests from accounts that should be limited to a single tenant context.
• Review all notification content and templates to ensure that sensitive PII or credentials are not being transmitted via system notifications until the upgrade is completed.