CVE-2026-116185Medium· 5.0▾ SunlitOpenRemote core before 1.31.0 contains an authorization bypass vulnerability that allows authenticated users to read other realms' gateway tunnel information via getGatewayActiveTunnelInfos. Attackers can request the gateway tunnel endpo…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 27.5 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Oct 26.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.2%
OpenRemote core before 1.31.0 contains an authorization bypass vulnerability that allows authenticated users to read other realms' gateway tunnel information via getGatewayActiveTunnelInfos. Attackers can request the gateway tunnel endpoint with their own realm and a victim gateway ID to disclose internal target hosts, ports, and routing data.
core < 1.31.0Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-116898High· 7.1REDAXO before 5.21.4 Missing Authorization in Media Pool Bulk Move
CVE-2026-116899Medium· 6.5REDAXO before 5.21.4 Broken Access Control in Slice Operations
CVE-2026-116184Low· 2.1OpenRemote before 1.31.0 Cross-Realm Gateway Impersonation via Websocket
CVE-2026-116186Low· 2.3OpenRemote before 1.31.0 Gateway Authorization Bypass via Reversible mapAssetId
CVE-2026-117533Medium· 4.4REDAXO 5.18.0 before 5.21.4 Stored XSS via Unsanitized Mediapool SVG Uploads
CVE-2026-116894Medium· 4.2REDAXO before 5.21.5 Insufficient Session Expiration on Password Change