CVE-2026-41166 OpenRemote has Improper Access Control via updateUserRealmRoles function
An attacker with write:admin in one realm can escalate privileges to master realm administrator by updating roles in other realms via the Manager API.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-41166?
CVE-2026-41166 is a high-severity missing authorization vulnerability in openremote, published on 22 Apr 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
OpenRemote is an open-source internet-of-things platform. Prior to version 1.22.1, a user who has `write:admin` in one Keycloak realm can call the Manager API to update Keycloak realm roles for users in another realm, including `master`. The handler uses the `{realm}` path segment when talking to the identity provider but does not check that the caller may administer that realm. This could result in a privilege escalation to `master` realm administrator if the attacker controls any user in `master` realm. Version 1.22.1 fixes the issue.
Weakness: CWE-284
Which versions are affected by CVE-2026-41166?
2 open source packages ship an affected version, including io.openremote:openremote-manager. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
io.openremote:openremote-manager Maven | All versions | 1.22.1 |
io.openremote:openremote-manager Maven | All versions | 1.22.1 |
Products include Openremote Openremote.
How do I fix CVE-2026-41166?
Upgrade io.openremote:openremote-manager to 1.22.1 or later.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-41166 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-41166 exists.
Other vulnerabilities in openremote
Sources
Also known as GHSA-49vv-25qx-mg44.