A critical privilege escalation vulnerability in OpenRemote allows attackers with limited realm access to compromise the master administrator account, potentially leading to a full platform takeover.

This vulnerability involves improper access control (CWE-284) within the Manager API, where the application fails to validate if an authenticated user possesses the required permissions for a target Keycloak realm. An attacker with write:admin access in one realm can manipulate roles in other realms, including the master realm.

The ability to escalate privileges to a master realm administrator grants an attacker full control over the IoT platform and its associated identity management system. This level of access leads to unauthorized data exposure, system manipulation, and potential disruption of critical infrastructure managed by the platform. With a CVSS score of 7.0, this high severity flaw poses a significant risk to operational integrity and security compliance.

Immediate Action: Upgrade the OpenRemote Manager component to version 1.22.1 or later immediately to apply the necessary authorization checks.

Proactive Monitoring: Review Keycloak realm role assignments and audit logs for unauthorized modifications to administrative accounts or unexpected cross-realm API activity.

Compensating Controls: Implement strict network segmentation to limit access to the Manager API and enforce the principle of least privilege for all user accounts within Keycloak.

Public Exploit Available: No (exploit_available: unknown)

Given the potential for complete identity provider compromise, organizations must prioritize upgrading to version 1.22.1. Verify that all administrative accounts are secured and audit current role configurations to ensure no unauthorized privilege escalation has already occurred.