# io.openremote:openremote-manager (Maven) vulnerabilities

8 known vulnerabilities (1 critical, 6 high, 1 medium), with the versions each affects and the releases that fix them.

## At a glance

- Latest release: 1.33.0 (Oct 27, 2026): no advisory affects it
- Newest unaffected release: 1.33.0 (Oct 27, 2026), the latest release
- Dependents: 6
- Releases: 70 since 1.2.0 (Dec 18, 2024)
- Registry: https://central.sonatype.com/artifact/io.openremote/openremote-manager
- Releases read: Nov 8, 2026

## Version timeline

Affected versions per advisory, in version order:

- CVE-2026-63224: 1.2.0 to 1.25.0 (1.26.0 is outside it)
- CVE-2026-54641: 1.2.0 to 1.24.1 (1.24.2 is outside it)
- CVE-2026-49439: 1.2.0 to 1.24.0 (1.24.1 is outside it)
- CVE-2026-62238: 1.2.0 to 1.25.0 (1.26.0 is outside it)
- CVE-2026-56784: 1.2.0 to 1.24.2 (1.25.0 is outside it)
- CVE-2026-40882: 1.2.0 to 1.21.0 (1.22.0 is outside it)
- CVE-2026-41166: 1.2.0 to 1.22.0 (1.22.1 is outside it)
- CVE-2026-39842: 1.2.0 to 1.21.0 (1.22.0 is outside it)

## Advisories (8)

### [CVE-2026-63224](https://cve.now/CVE-2026-63224): OpenRemote has authenticated SQL injection in crosstab datapoint exports

- Severity: High 7.2
- Published: Oct 30, 2026
- Affected: fixed in 1.26.0.
- Fixed in 1.26.0 (released Jun 30, 2026, 122 days before disclosure).
- The latest release, 1.33.0, is not affected.

### [CVE-2026-54641](https://cve.now/CVE-2026-54641): OpenRemote: Cross-Realm User Information Disclosure in UserResourceImpl

- Severity: High 7.7
- Published: Oct 13, 2026
- Affected: fixed in 1.24.2.
- Fixed in 1.24.2 (released Jun 11, 2026, 124 days before disclosure).
- The latest release, 1.33.0, is not affected.

### [CVE-2026-49439](https://cve.now/CVE-2026-49439): OpenRemote read-only asset users can write predicted datapoints

- Severity: Medium 4.3
- Published: Sep 11, 2026
- Affected: fixed in 1.24.1.
- Fixed in 1.24.1 (released Jun 1, 2026, 102 days before disclosure).
- The latest release, 1.33.0, is not affected.

### [CVE-2026-62238](https://cve.now/CVE-2026-62238): OpenRemote \< 1.26.0 SQL Injection via Crosstab Export

- Severity: High 7.2
- Published: Jul 17, 2026
- Affected: fixed in 1.26.0.
- Fixed in 1.26.0 (released Jun 30, 2026, 17 days before disclosure).
- The latest release, 1.33.0, is not affected.

### [CVE-2026-56784](https://cve.now/CVE-2026-56784): OpenRemote \< 1.25.0 IDOR via Bulk Alarm Deletion Endpoint

- Severity: High 8.6
- Published: Jun 23, 2026
- Affected: fixed in 1.25.0.
- Fixed in 1.25.0 (released Jun 18, 2026, 5 days before disclosure).
- The latest release, 1.33.0, is not affected.

### [CVE-2026-40882](https://cve.now/CVE-2026-40882): OpenRemote has XXE in Velbus Asset Import

- Severity: High 7.6
- Published: Apr 22, 2026
- Affected: fixed in 1.22.0.
- Fixed in 1.22.0 (released Apr 13, 2026, 9 days before disclosure).
- The latest release, 1.33.0, is not affected.

### [CVE-2026-41166](https://cve.now/CVE-2026-41166): OpenRemote has Improper Access Control via updateUserRealmRoles function

- Severity: High 7.0
- Published: Apr 22, 2026
- Affected: fixed in 1.22.1.
- Fixed in 1.22.1 (released Apr 20, 2026, 2 days before disclosure).
- The latest release, 1.33.0, is not affected.

### [CVE-2026-39842](https://cve.now/CVE-2026-39842): OpenRemote is Vulnerable to Expression Injection

- Severity: Critical 10.0
- Published: Apr 14, 2026
- Affected: fixed in 1.22.0.
- Fixed in 1.22.0 (released Apr 13, 2026, 1 day before disclosure).
- The latest release, 1.33.0, is not affected.

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/packages/maven/io.openremote:openremote-manager
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.