Security Advisory
CVE-2026-73616
CVE vulnerability detail - eXtreme Datacenter Security Operations
Description
OpenRemote notification deletion endpoints fail to enforce realm boundaries, allowing any realm administrator to delete notifications belonging to other realms. Attackers with write:admin role in one realm can send DELETE requests to remove notifications from the master realm or other tenants without authorization checks.