OpenBoxes CVE-2026-19928

Exploitation requires a valid authenticated session with a low-privileged OpenBoxes user account, consistent with PR:L in the CVSS 4.0 vector. The attack targets the /user/show, /user/edit, /user/create, and /user/list HTTP endpoints in UserController, which accepted and GORM-bound arbitrary role parameters without authorization checks. No non-default configuration is required - the flaw exists in the standard role enforcement logic of any affected OpenBoxes 0.9.7 or earlier deployment. Unauthenticated attackers cannot exploit this directly; a valid account is the minimum prerequisite. Exploitation is further limited to instances accessible from the attacker's network position, which for many deployments may be intranet-only, reducing internet-facing exposure.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N with E:P) indicates a network-exploitable flaw requiring only a valid low-privileged account, no attack complexity, and no special preconditions, with a public exploit modifier confirmed. The 5.3 Medium score reflects limited per-component CIA impact values (L/L/L on the vulnerable system) rather than low exploitability. Real-world risk should be assessed above what the numeric score implies: the public PoC on GitHub Gist substantially lowers the barrier to exploitation, and OpenBoxes deployments in humanitarian and healthcare supply chains handle sensitive inventory, procurement, and personnel data where unauthorized role elevation could allow an attacker to approve stock movements, access patient-linked records, or manipulate user accounts. CISA KEV status is absent, indicating no confirmed mass exploitation campaign at time of analysis, but the combination of public exploit code and low-complexity network access makes opportunistic exploitation realistic for any internet-exposed instance. EPSS data was not provided in the input; defenders should not rely on a low EPSS estimate to defer patching given the confirmed public PoC. No conflicting signals between CVSS and description were identified.

A public proof-of-concept exploit is available at https://gist.github.com/nedlir/2bc3a6e5bd4d67b863223e1bfc2e4390. An attacker with a standard warehouse staff account sends a crafted HTTP POST to the OpenBoxes /user/edit or /user/create endpoint, including injected role-assignment parameters (e.g., roles[0].id referencing a manager or administrator role); because the pre-patch controller passed these directly to GORM binding without authorization validation, the role is silently persisted to the database. The attacker's account - or a newly created account - then holds elevated privileges granting access to restricted procurement, inventory approval, and administrative functions.