EXECUTIVE SUMMARY:
CVE-2026-49439 with a CVSS score of 4.3 is a missing authorization vulnerability affecting the OpenRemote Manager package versions. This issue arises because the implementation incorrectly validates read access permissions instead of the required write permissions when processing requests to the predicted datapoint write endpoint. An attacker with a user account possessing only read-only asset privileges can exploit this flaw by sending crafted HTTP PUT requests to the specific API endpoint for asset prediction updates. Successful exploitation grants the attacker the ability to write or modify predicted datapoints within the system, effectively bypassing intended access controls. This unauthorized modification poses significant risks to data integrity and system reliability, as malicious actors could manipulate predicted values to disrupt automated decision-making processes or compromise operational reporting accuracy. Exploitation requires the attacker to have valid user credentials with read access to assets, but no special network configuration beyond the vulnerable software installation is necessary to execute the attack.[/subscribe_to_unlock_form]
EXECUTIVE SUMMARY:
CVE-2026-49439 with a CVSS score of 4.3 is a missing authorization vulnerability affecting the OpenRemote Manager package versions. This issue arises because the implementation incorrectly validates read access permissions instead of the required write permissions when processing requests to the predicted datapoint write endpoint. An attacker with a user account possessing only read-only asset privileges can exploit this flaw by sending crafted HTTP PUT requests to the specific API endpoint for asset prediction updates. Successful exploitation grants the attacker the ability to write or modify predicted datapoints within the system, effectively bypassing intended access controls. This unauthorized modification poses significant risks to data integrity and system reliability, as malicious actors could manipulate predicted values to disrupt automated decision-making processes or compromise operational reporting accuracy. Exploitation requires the attacker to have valid user credentials with read access to assets, but no special network configuration beyond the vulnerable software installation is necessary to execute the attack.[emaillocker id="1283"]
RECOMMENDATION:
REFERENCES:
The following reports contain further technical details:
https://github.com/advisories/GHSA-xj53-j257-hxvg