CVE-2026-124436

8 HIGHpublic exploit available

Published 2026-11-08 · Updated 2026-11-10

AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.

NVD description

OpenRemote before 1.32.2 contains an improper authorization vulnerability that allows realm administrators to access and modify global resources by calling admin endpoints lacking super administrator checks. Attackers can change the global keycloakUrl via /configuration/manager to redirect other realms' console authentication for credential phishing, inject CSS, replace map tiles, and delete logs.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Weaknesses

CWE-863

Public exploit & PoC references

https://github.com/openremote/core/security/advisories/GHSA-gf33-2772-8gw3
https://github.com/openremote/core/security/advisories/GHSA-gf33-2772-8gw3

All references

https://github.com/openremote/core/security/advisories/GHSA-gf33-2772-8gw3
https://www.vulncheck.com/advisories/openremote-before-1.32.2-improper-authorization-allows-realm-admins-to-modify-global-resources
https://github.com/openremote/core/security/advisories/GHSA-gf33-2772-8gw3

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

HIGHCVE-2024-22031PoC
MEDIUMCVE-2025-13050PoC
UNSCOREDCVE-2025-68392
HIGHCVE-2026-100105
MEDIUMCVE-2026-100145
UNSCOREDCVE-2026-100252
MEDIUMCVE-2026-100259
HIGHCVE-2026-100262

Related by shared AI tags and CWE weakness class. Browse the full archive.