CVE-2026-114661
OpenRemote 1.2.0 before 1.31.0 contains a missing authorization vulnerability in GatewayServiceResource that allows any authenticated user t
CVSS
8.5
Alta
EPSS
0.4%
p29
KEV
—
Exploit Today
9
0-100
Publicado: 22 de out. de 2026 · Última mod.: 28 de out. de 2026 · CWE-862
0.2%EPSS · 30 dias0.4%
2026-10-222026-11-07
OpenRemote 1.2.0 before 1.31.0 contains a missing authorization vulnerability in GatewayServiceResource that allows any authenticated user to start, stop and query gateway tunnels without an administrative role. Attackers can send POST or DELETE requests to the gateway tunnel endpoint to open persistent bidirectional TCP circuits into an edge gateway's network or tear down operator tunnels.
- github.comhttps://github.com/openremote/core/security/advisories/GHSA-5h8w-vg25-fw38
- www.vulncheck.comhttps://www.vulncheck.com/advisories/openremote-1.2.0-before-1.31.0-missing-authorization-in-gateway-tunnel-endpoints
- github.comhttps://github.com/openremote/core/security/advisories/GHSA-5h8w-vg25-fw38
CVECVSSEPSSKEVRExploitTítuloMod.
CVE-2026-1244888.1 ALT—
———OpenEMR before 8.3.0 contains an authorization bypass vulnerability that allows authenticated clinicians lacking high-sensitivity permission to read and modify encounter-bound forms via load_form.php. Attackers can request the Clinical Notes or Care Plan direct loader to obtain restricted content and a CSRF token, then submit save.php to tamper with clinical records.50mCVE-2026-1244868.8 ALT—
———OpenEMR before 8.3.0 contains a missing authorization vulnerability in the classic document controller that allows low-privilege authenticated users to recategorize other patients' documents. Attackers can invoke move_action_process to move a document into a patients|demo category, then retrieve it with an empty patient_id to exfiltrate PHI and tamper with charts.50mCVE-2026-1244848.8 ALT—
———OpenEMR before 8.4.0 contains a missing authorization vulnerability in portal onsite-document APIs that allows any authenticated core user to access cross-patient documents. Attackers can omit the patientId parameter and supply arbitrary record IDs to list, read, and overwrite other patients' portal documents, signatures, and template data.50mCVE-2026-1244808.8 ALT—
———OpenEMR before 8.4.0 contains an authorization bypass vulnerability that allows low-privileged authenticated users to read cross-patient FHIR QuestionnaireResponse data by sending the APICSRFTOKEN header. Attackers can reuse the session-exposed api_csrf_token_js value to skip FHIR scope checks and call GET /fhir/QuestionnaireResponse, exfiltrating site-wide questionnaire answer PHI.50mCVE-2026-1244786.5 MÉD—
———OpenEMR before 8.3.0 contains a missing authorization vulnerability in the addRecall action of /interface/main/messages/save.php that allows low-privileged authenticated users to modify arbitrary patients' recall data. Attackers can submit a crafted new_pid with recall, contact, provider, facility, and notification preference fields to overwrite records of patients they cannot access.50mCVE-2026-1244778.8 ALT—
———OpenEMR before 8.3.0 contains a missing authorization vulnerability that allows low-privileged authenticated users to delete arbitrary patient recall records via the delete_Recall action. Attackers can send POST requests to /interface/main/messages/save.php with a target pid and r_ID to remove recall data without ACL or ownership checks.50m