What is GHSA-fgj3-5frq-8vw8?

GHSA-fgj3-5frq-8vw8 is a security advisory published by GitHub Security Advisories with High severity. OpenRemote versions before 1.28.0 contain a cross-realm information disclosure vulnerability in...

Which CVE IDs does GHSA-fgj3-5frq-8vw8 cover?

GHSA-fgj3-5frq-8vw8 covers the following CVE IDs: CVE-2026-81679. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-fgj3-5frq-8vw8?

GHSA-fgj3-5frq-8vw8 has a CVSS v3 base score of 7.7, published by GitHub Security Advisories.

GHSA-fgj3-5frq-8vw8HighCVSS 7.7

OpenRemote versions before 1.28.0 contain a cross-realm information disclosure vulnerability in...

Vendor

GitHub Security Advisories

Published

August 27, 2026

Last Modified

August 27, 2026

🔗 CVE IDs covered (1)

CVE-2026-81679 →

📋 Description

OpenRemote versions before 1.28.0 contain a cross-realm information disclosure vulnerability in the Notification REST API that allows per-realm tenant administrators to read all tenants' sent notifications including message bodies. Attackers with read:admin credentials in one realm can submit a zero-parameter GET request to the notification endpoint to retrieve sensitive notification metadata and message content from all realms.

🔗 References (4)

https://github.com/openremote/openremote/security/advisories/GHSA-6ff4-4frc-r287
https://nvd.nist.gov/vuln/detail/CVE-2026-81679
https://www.vulncheck.com/advisories/openremote-before-1.28.0-cross-realm-information-disclosure-via-notification-api
https://github.com/advisories/GHSA-fgj3-5frq-8vw8