CVE-2026-81679 OpenRemote before 1.28.0 Cross-Realm Information Disclosure via Notification API
Tenant administrators can read all tenants' notification data via the Notification API, exposing sensitive message content across realms.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-81679?
CVE-2026-81679 is a high-severity vulnerability in openremote, published on 27 Aug 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
OpenRemote versions before 1.28.0 contain a cross-realm information disclosure vulnerability in the Notification REST API that allows per-realm tenant administrators to read all tenants' sent notifications including message bodies. Attackers with read:admin credentials in one realm can submit a zero-parameter GET request to the notification endpoint to retrieve sensitive notification metadata and message content from all realms.
Weakness: CWE-200
Which versions are affected by CVE-2026-81679?
How do I fix CVE-2026-81679?
No fix has been published for CVE-2026-81679 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-81679 being exploited?
There is no known exploitation of CVE-2026-81679 in the wild and no public exploit code.
Sources
Also known as GHSA-6ff4-4frc-r287, GHSA-fgj3-5frq-8vw8.