| Reporter | Title | Published | Views | Family All 12 |
|---|---|---|---|---|
 | CVE-2026-54641 | 6 Jul 202622:35 | – | circl |
 | CVE-2026-54641 OpenRemote: Cross-Realm User Information Disclosure in UserResourceImpl | 13 Oct 202616:07 | – | cvelist |
 | EUVD-2026-98846 | 13 Oct 202616:07 | – | euvd |
 | OpenRemote has Cross-Realm User Information Disclosure in UserResourceImpl | 6 Jul 202620:47 | – | github |
 | CVE-2026-54641 | 6 Jul 202621:32 | – | mend |
 | CVE-2026-54641 | 13 Oct 202617:17 | – | nvd |
 | GHSA-XQR9-4WVV-GVCH OpenRemote has Cross-Realm User Information Disclosure in UserResourceImpl | 6 Jul 202620:47 | – | osv_ghsa |
 | PT-2026-56060 | 6 Jul 202600:00 | – | ptsecurity |
 | CVE-2026-54641: Authorization Bypass Through User-Controlled Key | 13 Oct 202600:00 | – | rapid7 |
 | Authorization Bypass Through User-Controlled Key | 6 Jul 202620:47 | – | snyk |
10
Node
[
{
"vendor": "openremote",
"product": "openremote",
"versions": [
{
"version": "< 1.24.2",
"status": "affected"
}
]
}
]| Parameter | Position | Path | Description | CWE |
|---|---|---|---|---|
| uuid | path | /api/v1/users | The get method in UserResourceImpl fails to verify that the target user UUID belongs to the authenticated realm, allowing a realm administrator to retrieve profile information of users from other tenants. | CWE-639 |
| uuid | path | /api/v1/users | The getUserClientRoles method fails to verify that the target user UUID belongs to the authenticated realm, allowing a realm administrator to retrieve client roles of users from other tenants. | CWE-639 |
| uuid | path | /api/v1/users | The getUserRealmRoles method fails to verify that the target user UUID belongs to the authenticated realm, allowing a realm administrator to retrieve realm roles of users from other tenants. | CWE-639 |
Data
Build on a solid foundation with Vulners data
We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data
Api
Power your application with Vulners API
The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access
App
Assess and manage vulnerabilities with Vulners tools
Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation
13 Oct 2026 18:17Current
5.8Medium risk
Vulners AI Score5.8
CVSS 3.17.7
EPSS0.00293
SSVC