Description
A weakness has been identified in OpenBoxes up to 0.9.2. This vulnerability affects unknown code of the file grails-app/controllers/org/pih/warehouse/RoleInterceptor.groovy of the component Product Supplier Edit Controller. Executing a manipulation can lead to improper authorization. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks. Upgrading to version 0.9.3 is able to resolve this issue. This patch is called f767ac1a5987d4865d9f158c6a967680f8e45468. It is suggested to upgrade the affected component.
Published: 2026-08-18
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

This vulnerability arises from an improper authorization check within the RoleInterceptor in OpenBoxes, allowing attackers to manipulate product supplier records. The flaw permits unauthorized modification of supplier data, potentially compromising the integrity of inventory management. The weakness resides in the Product Supplier Edit Controller, which can be exploited remotely with crafted requests.

Affected Systems

Vulnerable OpenBoxes installations running any version up to 0.9.2 are impacted. The issue is confined to the grails-app/controllers/org/pih/warehouse/RoleInterceptor.groovy component. Upgrading to version 0.9.3 or a later release that incorporates the commit f767ac1a5987d4865d9f158c6a967680f8e45468 removes the vulnerability.

Risk and Exploitability

The CVSS score of 5.3 indicates a moderate severity. No EPSS score is available, and the vulnerability has not been listed in CISA's KEV catalog. The attack vector is remote, and exploitation code is publicly available, making the threat credible under current exposure. Administrators should assess whether their environment exposes the vulnerable endpoint and apply the patch promptly.

Generated by OpenCVE AI on August 18, 2026 at 10:21 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade OpenBoxes to version 0.9.3 or later, which includes the f767ac1a5987d4865d9f158c6a967680f8e45468 fix.
  • Verify that the system is not running a pre‑0.9.3 release; if upgrade is not immediately possible, restrict access to the Product Supplier Edit controller to privileged roles.
  • After applying the upgrade, review role‑based access controls to ensure that only authorized users can edit supplier data.

Generated by OpenCVE AI on August 18, 2026 at 10:21 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 18 Aug 2026 14:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 18 Aug 2026 09:00:00 +0000

Type Values Removed Values Added
Description A weakness has been identified in OpenBoxes up to 0.9.2. This vulnerability affects unknown code of the file grails-app/controllers/org/pih/warehouse/RoleInterceptor.groovy of the component Product Supplier Edit Controller. Executing a manipulation can lead to improper authorization. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks. Upgrading to version 0.9.3 is able to resolve this issue. This patch is called f767ac1a5987d4865d9f158c6a967680f8e45468. It is suggested to upgrade the affected component.
Title OpenBoxes Product Supplier Edit Controller RoleInterceptor.groovy improper authorization
First Time appeared Openboxes
Openboxes openboxes
Weaknesses CWE-266
CWE-285
CPEs cpe:2.3:a:openboxes:openboxes:*:*:*:*:*:*:*:*
Vendors & Products Openboxes
Openboxes openboxes
References
Metrics cvssV2_0

{'score': 6.5, 'vector': 'AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:OF/RC:C'}

cvssV3_0

{'score': 6.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C'}

cvssV3_1

{'score': 6.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Openboxes Openboxes
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-08-18T13:30:09.395Z

Reserved: 2026-08-16T05:47:41.619Z

Link: CVE-2024-14045

cve-icon Vulnrichment

Updated: 2026-08-18T13:30:04.433Z

cve-icon NVD

Status : Deferred

Published: 2026-08-18T09:16:45.447

Modified: 2026-08-20T12:48:31.843

Link: CVE-2024-14045

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-18T10:30:10Z

Weaknesses
  • CWE-266

    Incorrect Privilege Assignment

  • CWE-285

    Improper Authorization