OpenRemote: Improper authorization in admin endpoints (CVE-2026-124436)

OpenRemote versions before 1.32.2 are vulnerable to an improper authorization flaw. Realm administrators can invoke administrative endpoints without sufficient super-administrator validation, granting them control over global system configuration. Confirmed impacts include the modification of the 'keycloakUrl' for credential phishing redirection, malicious CSS injection, map tile replacement, and unauthorized deletion of system logs.

Impact

Successful exploitation allows a realm administrator to perform unauthorized actions including credential harvesting, content manipulation, and log destruction, potentially leading to persistent account takeover or loss of auditability.

Recommendation

• Upgrade OpenRemote to version 1.32.2 or later to include the required authorization checks.
• Review system and audit logs for unauthorized requests directed at the '/configuration/manager' endpoint or other administrative API paths if an upgrade cannot be performed immediately.
• Audit current global configuration settings, specifically the 'keycloakUrl' value, to ensure they match expected internal authentication providers.