OpenRemote contains a vulnerability in its notification deletion endpoints where realm boundaries are not enforced. This flaw allows any realm administrator with write:admin privileges in one realm to delete notifications belonging to other realms, including the master realm or other tenants. The vulnerability does not affect confidentiality or availability but impacts integrity by enabling unauthorized deletion of notifications.