CVE-2026-73616
MEDIUM
NVD
CVSS Score
6.5
Severity
MEDIUM
Published
Aug 13, 2026
Vendor
unknown
Description
OpenRemote notification deletion endpoints fail to enforce realm boundaries, allowing any realm administrator to delete notifications belonging to other realms. Attackers with write:admin role in one realm can send DELETE requests to remove notifications from the master realm or other tenants without authorization checks.