OpenRemote versions prior to 1.25.0 are vulnerable to an IDOR flaw that enables unauthorized deletion of cross-tenant data.

This is an Insecure Direct Object Reference (IDOR) vulnerability. It allows authenticated users who possess alarm-write permissions to bypass multi-tenant isolation and permanently delete alarms belonging to other tenants by manipulating alarm ID parameters.

With a CVSS score of 8.1, this vulnerability poses a significant risk to data integrity and multi-tenant isolation. A successful exploit allows a malicious or compromised user to disrupt operations for other tenants, leading to potential data loss and a breach of service-level agreements regarding data privacy and separation.

Immediate Action: Upgrade all instances of OpenRemote to version 1.25.0 or later to ensure proper authorization checks are enforced.

Proactive Monitoring: Review access and audit logs for unusual patterns of alarm deletion, specifically monitoring for requests involving non-owned alarm IDs.

Compensating Controls: Restrict "alarm-write" permissions to only the most trusted users and implement strict network segmentation where possible until the patch is applied.

Public Exploit Available: false

The severity of this IDOR vulnerability necessitates immediate attention, particularly for multi-tenant environments where data isolation is paramount. Administrators should prioritize updating to version 1.25.0 to restore proper access control mechanisms and prevent cross-tenant data destruction.