CVE-2026-114661

OpenRemote versions 1.2.0 before 1.31.0 are vulnerable to a missing authorization flaw in the GatewayServiceResource component. This vulnerability allows any authenticated user—regardless of whether they hold an administrative role—to perform unauthorized actions such as starting, stopping, or qu...

EUVD-2026-107903

OpenRemote 1.2.0 before 1.31.0 contains a missing authorization vulnerability in GatewayServiceResource that allows any authenticated user to start, stop and query gateway tunnels without an administrative role. Attackers can send POST or DELETE requests to the gateway tunnel endpoint to open...