{"id":"CVE-2026-116186","published":"2026-10-25T14:16:58.677","lastModified":"2026-10-26T17:01:22.130","description":"OpenRemote core (openremote-manager) before 1.31.0 does not perform realm or gateway-descendant authorization on inbound edge gateway events and maps event asset IDs only through the reversible GatewayConnector.mapAssetId transform. An attacker controlling a registered gateway can craft pre-image IDs in AttributeEvent or DELETE AssetEvent messages to overwrite attributes on, or delete, assets in any realm, breaking tenant isolation.","cvssScore":null,"cvssSeverity":null,"cvssVector":null,"cwes":["CWE-639"],"vendors":[],"products":[],"references":[{"url":"https://github.com/openremote/core/security/advisories/GHSA-8pjc-wq2p-3xr4","tags":[]},{"url":"https://www.vulncheck.com/advisories/openremote-before-1.31.0-gateway-authorization-bypass-via-reversible-mapassetid","tags":[]}],"exploitRefs":[{"url":"https://github.com/openremote/core/security/advisories/GHSA-8pjc-wq2p-3xr4","tags":[]}],"hasPoc":true,"ai":null}