CVE-2026-49439: Openremote

Medium severity, CVSS 4.3. EPSS: 0.3% chance of exploitation in the next 30 days.

OpenRemote is an open-source internet-of-things platform. Prior to version 1.24.1, the predicted datapoint write endpoint allows users with only `read:assets` privileges to write predicted datapoints. Version 1.24.1 fixes the issue.

Affected products

• Openremote Openremote: before 1.24.1 (fixed in 1.24.1)

Published 2026-09-11. Last modified 2026-09-23.