{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/openremote--1.32.2/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:openremote:openremote:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":8,"id":"CVE-2026-124436"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["OpenRemote (\u003c 1.32.2)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["OpenRemote"],"content_html":"\u003cp\u003eOpenRemote versions before 1.32.2 are vulnerable to an improper authorization flaw. Realm administrators can invoke administrative endpoints without sufficient super-administrator validation, granting them control over global system configuration. Confirmed impacts include the modification of the 'keycloakUrl' for credential phishing redirection, malicious CSS injection, map tile replacement, and unauthorized deletion of system logs.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows a realm administrator to perform unauthorized actions including credential harvesting, content manipulation, and log destruction, potentially leading to persistent account takeover or loss of auditability.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade OpenRemote to version 1.32.2 or later to include the required authorization checks.\u003c/li\u003e\n\u003cli\u003eReview system and audit logs for unauthorized requests directed at the '/configuration/manager' endpoint or other administrative API paths if an upgrade cannot be performed immediately.\u003c/li\u003e\n\u003cli\u003eAudit current global configuration settings, specifically the 'keycloakUrl' value, to ensure they match expected internal authentication providers.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-08T15:30:35Z","date_published":"2026-11-08T15:30:35Z","id":"https://feed.craftedsignal.io/briefs/2026-11-openremote-auth-vuln/","summary":"OpenRemote versions prior to 1.32.2 contain an authorization flaw allowing realm administrators to perform unauthorized modifications of global resources by accessing restricted administrative endpoints.","title":"OpenRemote: Improper authorization in admin endpoints (CVE-2026-124436)","url":"https://feed.craftedsignal.io/briefs/2026-11-openremote-auth-vuln/"}],"language":"en","title":"CraftedSignal Threat Feed - OpenRemote (\u003c 1.32.2)","version":"https://jsonfeed.org/version/1.1"}