CVE-2026-49439 OpenRemote read-only asset users can write predicted datapoints
Attackers with read-only asset privileges can write predicted datapoints in OpenRemote, allowing unauthorized data modification.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-49439?
CVE-2026-49439 is a medium-severity missing authorization vulnerability in openremote, published on 11 Sep 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
OpenRemote is an open-source internet-of-things platform. Prior to version 1.24.1, the predicted datapoint write endpoint allows users with only `read:assets` privileges to write predicted datapoints. Version 1.24.1 fixes the issue.
Weakness: CWE-862
Which versions are affected by CVE-2026-49439?
2 open source packages ship an affected version, including io.openremote:openremote-manager.
| Package | Affected | Fixed in |
|---|---|---|
io.openremote:openremote-manager Maven | All versions | 1.24.1 |
io.openremote:openremote-manager Maven | All versions | 1.24.1 |
How do I fix CVE-2026-49439?
Upgrade io.openremote:openremote-manager to 1.24.1 or later.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-49439 being exploited?
There is no known exploitation of CVE-2026-49439 in the wild and no public exploit code.
Sources
Also known as GHSA-xj53-j257-hxvg.