CVE-2026-49439

描述

# Summary The predicted datapoint write endpoint allows users with only `read:assets` privileges to write predicted datapoints. The endpoint: ```text PUT /api/{realm}/asset/predicted/{assetId}/{attributeName} ``` accepts write requests from users lacking `write:assets`. The implementation appears to check `READ_ASSETS` while performing a write operation through: ```java assetPredictedDatapointService.updateValues(...) ``` # PoC A user was created with only: ```text read:assets ``` and without `write:assets`. The following request succeeded: ```http PUT /api/master/asset/predicted/4Fr8Pcp7iDjrEmoSUFolvT/temperature ``` Request body: ```json [{"x":1779199999001,"y":1337}] ``` Response: ```text HTTP/2 204 ``` Database verification confirmed the datapoint was written successfully: ```text entity_id: 4Fr8Pcp7iDjrEmoSUFolvT attribute_name: temperature value: 1337 ``` # Impact Users with read-only asset permissions can modify predicted datapoints for assets.

如何修補 CVE-2026-49439

要修補 CVE-2026-49439,請將受影響套件升級到下列已修補版本。

• —升級至 1.24.1 或更新版本

CVE-2026-49439 正在被利用嗎?

目前沒有被利用訊號。CVE-2026-49439 既不在 CISA KEV 也沒有最新的 EPSS 分數。

受影響套件(1)

• from 0, < 1.24.1

CVSS 分數

參考連結(3)

• PATCHgithub.com/openremote/openremote
• WEBgithub.com/openremote/openremote/commit/583dbbfb96076ba099be8729ddf506acf9e48325
• WEBgithub.com/openremote/openremote/security/advisories/GHSA-xj53-j257-hxvg