OpenRemote (< 1.32.2) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/openremote--1.32.2/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioSun, 08 Nov 2026 15:30:35 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgOpenRemote: Improper authorization in admin endpoints (CVE-2026-124436)https://feed.craftedsignal.io/briefs/2026-11-openremote-auth-vuln/Sun, 08 Nov 2026 15:30:35 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-openremote-auth-vuln/OpenRemote versions prior to 1.32.2 contain an authorization flaw allowing realm administrators to perform unauthorized modifications of global resources by accessing restricted administrative endpoints.OpenRemote versions before 1.32.2 are vulnerable to an improper authorization flaw. Realm administrators can invoke administrative endpoints without sufficient super-administrator validation, granting them control over global system configuration. Confirmed impacts include the modification of the 'keycloakUrl' for credential phishing redirection, malicious CSS injection, map tile replacement, and unauthorized deletion of system logs.

Impact

Successful exploitation allows a realm administrator to perform unauthorized actions including credential harvesting, content manipulation, and log destruction, potentially leading to persistent account takeover or loss of auditability.

Recommendation

  • Upgrade OpenRemote to version 1.32.2 or later to include the required authorization checks.
  • Review system and audit logs for unauthorized requests directed at the '/configuration/manager' endpoint or other administrative API paths if an upgrade cannot be performed immediately.
  • Audit current global configuration settings, specifically the 'keycloakUrl' value, to ensure they match expected internal authentication providers.
]]>highadvisory