CVE-2026-49439— OpenRemote read-only asset users can write predicted datapoints
Quick assessment
Affected
openremote openremote
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
OpenRemote 是一个开源的物联网平台。在 1.24.1 版本之前，预测数据点写入端点（predicted datapoint write endpoint）存在权限控制缺陷：仅拥有 权限的用户也可以写入预测数据点。该问题已在 1.24.1 版本中修复。
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-49439
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
OpenRemote read-only asset users can write predicted datapoints
Source: CVE Program / CVE List V5
Vulnerability Description
OpenRemote is an open-source internet-of-things platform. Prior to version 1.24.1, the predicted datapoint write endpoint allows users with only `read:assets` privileges to write predicted datapoints. Version 1.24.1 fixes the issue.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
授权机制缺失
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| openremote | openremote | < 1.24.1 | - |
|
II. Public POCs for CVE-2026-49439
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-49439
请登录查看更多情报信息。
Other References for CVE-2026-49439 (2)
-
https://github.com/openremote/openremote/security/advisories/GHSA-xj53-j257-hxvg x_refsource_CONFIRM
IV. Related Vulnerabilities
Same product: openremote
-
CVE-2026-81679
OpenRemote before 1.28.0 Cross-Realm Information Disclosure -
CVE-2026-73616
OpenRemote Notification Delete Cross-Realm Insecure Direct O -
CVE-2026-67310
openremote before 1.27.0 Cross-Tenant IDOR via setAssetLinks -
CVE-2026-66013
OpenRemote before 1.26.2 Authentication Bypass via Console R -
CVE-2026-65009
OpenRemote before 1.26.2 Information Disclosure via Syslog R
Same vendor: openremote
-
CVE-2026-81679
OpenRemote before 1.28.0 Cross-Realm Information Disclosure -
CVE-2026-73616
OpenRemote Notification Delete Cross-Realm Insecure Direct O -
CVE-2026-67310
openremote before 1.27.0 Cross-Tenant IDOR via setAssetLinks -
CVE-2026-66013
OpenRemote before 1.26.2 Authentication Bypass via Console R -
CVE-2026-65009
OpenRemote before 1.26.2 Information Disclosure via Syslog R
Same weakness: CWE-862
-
CVE-2026-68535
Concrete CMS 9.2.0 to 9.5.2 is vulnerable to Missing authori -
CVE-2026-81916
Incorrect Authorization in the Concrete CMS Express Entries -
CVE-2026-81915
In Concrete CMS below 9.5.3, Page Type update omits object- -
CVE-2026-62089
WordPress Master Addons for Elementor plugin <= 3.2.2 - Brok -
CVE-2026-62137
WordPress bbPress plugin <= 2.6.14 - Sensitive Data Exposure
V. Comments for CVE-2026-49439
No comments yet