CVE-2026-111721 in Open WES
Summary
by MITRE • 10/16/2026
Open WES through 1.0.0 contains an authorization bypass vulnerability that allows authenticated users to modify other warehouses' stock records because GlobalGatewayFilter never enforces auth_warehouse scoping. Attackers holding the menu permission can enumerate sequential IDs on freezeContainerStock and unfreezeContainerStock endpoints to freeze or unfreeze container stock in other warehouses.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/16/2026
The vulnerability identified within Open WES version 1.0.0 represents a critical failure in server-side access control, specifically manifesting as an authorization bypass that allows authenticated users to manipulate resources belonging to different organizational entities. This flaw is rooted in the improper implementation of scope enforcement for warehouse-specific data isolation. The system relies on a component named GlobalGatewayFilter to manage authentication and authorization checks; however, this filter fails to validate or enforce the auth_warehouse scoping parameter when processing requests directed at stock management endpoints. Consequently, while the application correctly verifies that a user is authenticated and possesses general menu permissions, it neglects to ensure that the specific warehouse context associated with the request matches the authorized scope of the current session. This architectural oversight creates a scenario where the identity verification step succeeds, but the subsequent authorization check for resource ownership is entirely skipped or bypassed due to missing logic in the gateway layer.
From a technical perspective, this vulnerability falls under the category of Broken Access Control, which corresponds to CWE-269 in the Common Weakness Enumeration standard. The specific mechanism exploited involves the manipulation of sequential identifiers associated with container stock records. Because the GlobalGatewayFilter does not inject or validate warehouse context into the business logic layer for these operations, an attacker can leverage this gap by enumerating sequential IDs on endpoints such as freezeContainerStock and unfreezeContainerStock. By systematically iterating through integer values representing different containers across various warehouses, the malicious actor can successfully execute state-changing actions on stock records that they do not own or have permission to access. This lack of object-level authorization control means that any authenticated user with basic menu privileges can effectively act as an administrator for other warehouses' inventory systems, provided they can guess or enumerate the correct resource identifiers.
The operational impact of this vulnerability is severe and multifaceted, affecting both data integrity and business continuity within warehouse management operations. An attacker who successfully exploits this flaw can freeze container stock in unauthorized warehouses, rendering those items unavailable for picking, packing, or shipping without triggering any security alerts or access denials. Conversely, the ability to unfreeze previously frozen containers allows an adversary to artificially inflate inventory availability metrics, potentially leading to overselling of out-of-stock items and subsequent customer dissatisfaction. Furthermore, because these actions are performed by authenticated users with legitimate credentials, traditional audit logs may not immediately distinguish between authorized administrative changes and malicious unauthorized modifications based solely on user identity. This ambiguity complicates forensic analysis and incident response efforts, as distinguishing valid operational adjustments from security breaches requires deep inspection of request parameters against expected warehouse scopes.
In alignment with the MITRE ATT&CK framework, this vulnerability facilitates techniques related to Privilege Escalation via Horizontal Access Control Bypass (T1078.004) and potentially Data Manipulation through unauthorized API calls. The exploitation path relies heavily on sequential ID enumeration, which is a common pattern in applications that use predictable identifiers without implementing proper access controls or anti-enumeration measures such as UUIDs or randomized tokens. To mitigate this risk, developers must immediately patch the GlobalGatewayFilter to enforce strict scoping rules for all warehouse-related operations. This involves ensuring that every request targeting stock management endpoints includes and validates a context identifier that matches the user's assigned warehouse permissions at the authorization layer, not just the authentication layer. Additionally implementing rate limiting on these endpoints can help mitigate the efficiency of ID enumeration attacks by introducing latency to brute-force attempts. Long-term remediation should include adopting non-sequential identifiers for internal resources and conducting a comprehensive review of all API endpoints to ensure that object-level access controls are consistently applied across the entire application surface area, thereby preventing unauthorized cross-entity data manipulation.