Open WES CVE-2026-111721

Requires an authenticated Open WES account holding the 'menu' permission that grants access to the freezeContainerStock and unfreezeContainerStock endpoints; no warehouse-scope authorization is enforced by GlobalGatewayFilter, so such a user can target any warehouse by enumerating sequential container-stock IDs. Limiting factors: exploitation is impossible without valid authenticated credentials (PR:L), impact is confined to freezing/unfreezing stock (integrity/availability only, no data disclosure), and only Open WES versions through 1.0.0 are affected.

This is a moderate-risk authorization flaw (CWE-639 IDOR) rather than a critical one, and the signals are internally consistent. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) scores 5.3 and correctly reflects a network-reachable but authenticated-only issue - PR:L confirms the attacker must already hold a valid account with the 'menu permission.' Impact is limited: VC:N/VI:L/VA:L means no confidentiality loss and only partial integrity/availability impact (freezing/unfreezing stock), with no scope change (SC:N/SI:N/SA:N). No EPSS score, CISA KEV entry, or POC flag was supplied in the input, so there is no public exploit identified at time of analysis; the referenced hackmd write-up and GitHub source-line pointers constitute a public root-cause analysis, not confirmed weaponized exploit code. The practical risk is driven by how easily an already-authenticated low-privilege user can abuse sequential ID enumeration against unscoped endpoints - trivial once access exists - but it is gated entirely behind authentication and is confined to a niche product, so this is a real but bounded insider/low-privilege integrity issue, not a widespread unauthenticated emergency.

A low-privileged but authenticated Open WES user holding the 'menu' permission sends requests to the freezeContainerStock or unfreezeContainerStock endpoints while iterating sequential container-stock IDs. Because GlobalGatewayFilter never checks the auth_warehouse scope, the user freezes or unfreezes stock belonging to warehouses they should not control, disrupting inventory operations. No public exploit code is identified, but the attack requires only standard authenticated API calls (AV:N/AC:L).