PT-2026-71387

An incorrect authorization check in the v2 Alarm REST API in OpenNMS Meridian and Horizon allows a low-privileged authenticated user ROLE REST to acknowledge, escalate, or clear alarms recorded as an arbitrary username, and, when also assigned ROLE READONLY, to modify alarm state despite the...