CVE-2026-54641

The OpenRemote IoT platform is vulnerable to Cross-Realm User Information Disclosure in the UserResourceImpl.java component. Prior to version 1.24.2 , the get, getUserClientRoles, and getUserRealmRoles methods fail to verify if the target user's UUID belongs to the authenticated realm, despite re...