CVE-2026-114661: Critical Missing Authorization in OpenRemote GatewayServiceResource
A critical vulnerability (CVE-2026-114661, CVSS 8.5) exists in OpenRemote versions 1.2.0 before 1.31.0, allowing any authenticated user to start, stop, and query gateway tunnels without administrative privileges. This missing authorization vulnerability enables attackers to open persistent bidirectional TCP circuits into an edge gateway's network or disrupt operator tunnels. Immediate patching to version 1.31.0 or later is strongly recommended.