EUVD-2026-103013
GHSA-5ww9-qwj2-mr7g
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate with menu permission
-
DeliveryCall freeze/unfreeze stock endpoint
-
ExploitEnumerate sequential container stock IDs
-
ExecutionBypass missing warehouse scope check
-
ImpactFreeze/unfreeze other warehouses' stock
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Object-level authorization, IDOR prevention
|
| Exploitation Conditions | Requires an authenticated Open WES account holding the 'menu' permission that grants access to the freezeContainerStock and unfreezeContainerStock endpoints; no warehouse-scope authorization is enforced by GlobalGatewayFilter, so such a user can target any warehouse by enumerating sequential container-stock IDs. Limiting factors: exploitation is impossible without valid authenticated credentials (PR:L), impact is confined to freezing/unfreezing stock (integrity/availability only, no data disclosure), and only Open WES versions through 1.0.0 are affected. |
| Impact | This is a moderate-risk authorization flaw (CWE-639 IDOR) rather than a critical one, and the signals are internally consistent. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) scores 5.3 and correctly reflects a network-reachable but authenticated-only issue - PR:L confirms the attacker must already hold a valid account with the 'menu permission.' Impact is limited: VC:N/VI:L/VA:L means no confidentiality loss and only partial integrity/availability impact (freezing/unfreezing stock), with no scope change (SC:N/SI:N/SA:N). No EPSS score, CISA KEV entry, or POC flag was supplied in the input, so there is no public exploit identified at time of analysis; the referenced hackmd write-up and GitHub source-line pointers constitute a public root-cause analysis, not confirmed weaponized exploit code. The practical risk is driven by how easily an already-authenticated low-privilege user can abuse sequential ID enumeration against unscoped endpoints - trivial once access exists - but it is gated entirely behind authentication and is confined to a niche product, so this is a real but bounded insider/low-privilege integrity issue, not a widespread unauthenticated emergency. |
| Exploit ScenarioDerived | A low-privileged but authenticated Open WES user holding the 'menu' permission sends requests to the freezeContainerStock or unfreezeContainerStock endpoints while iterating sequential container-stock IDs. Because GlobalGatewayFilter never checks the auth_warehouse scope, the user freezes or unfreezes stock belonging to warehouses they should not control, disrupting inventory operations. No public exploit code is identified, but the attack requires only standard authenticated API calls (AV:N/AC:L). |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 16, 2026
Open WES through 1.0.0 does not enforce warehouse-scope authorization in GlobalGatewayFilter, so an authenticated user who holds the menu permission for the stock endpoints can freeze or unfreeze container stock belonging to any warehouse by enumerating sequential IDs on the freezeContainerStock and unfreezeContainerStock endpoints. This is a moderate-severity authorization bypass (CWE-639 IDOR; CVSS 5.3) with integrity and availability impact only, and no public exploit identified at time of analysis. Only installations up to and including version 1.0.0 are affected.
RemediationAI
No vendor-released patch identified at time of analysis. Until a fix is available, apply the following compensating controls: (1) At the gateway layer, add an explicit authorization check that loads the target container-stock record and verifies its warehouse ID matches the authenticated user's auth_warehouse before allowing freezeContainerStock or unfreezeContainerStock; this requires code changes but directly addresses the missing scope enforcement. (2) Restrict the menu permission that grants access to these endpoints to users who genuinely need cross-warehouse stock control, or map it to a narrower role; the trade-off is reduced functionality for legitimate warehouse operators. (3) Replace sequential container-stock IDs with unguessable UUIDs or include the warehouse ID in the request and validate it server-side, though schema/API changes may break existing integrations. (4) Rate-limit and monitor calls to freezeContainerStock and unfreezeContainerStock for sequential ID enumeration patterns; this detects but does not prevent abuse and may generate false positives during bulk operations. Consult the VulnCheck advisory (https://www.vulncheck.com/advisories/open-wes-through-1.0.0-broken-access-control-via-globalgatewayfilter-warehouse-scoping) and the source references for updates. The primary fix should enforce warehouse scoping in GlobalGatewayFilter and ContainerStockController in a manner consistent with the project's authorization model.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is an instance of CWE-639 (Authorization Bypass Through User-Controlled Key), a form of insecure direct object reference (IDOR). In Open WES 1.0.0, the Java gateway filter GlobalGatewayFilter (server/modules-gateway/gateway-core/src/main/java/org/openwes/gateway/filter/GlobalGatewayFilter.java, lines 86-128) is intended to validate requests but never checks that the requested container-stock record belongs to the caller's auth_warehouse. ContainerStockController (server/modules-wes/wes-stock/src/main/java/org/openwes/wes/stock/controller/ContainerStockController.java, lines 24-34) exposes freezeContainerStock and unfreezeContainerStock operations that accept container-stock IDs; because those IDs are sequential and the filter does not scope them, any authenticated user with the menu permission can iterate IDs and affect other warehouses. The CPE cpe:2.3:a:jingsewu:open-wes:*:*:*:*:*:*:*:* identifies the affected open-source project (GitHub jingsewu/open-wes) through version 1.0.0.
Know when Open Wes gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N
Network API endpoints (AV:N), trivial ID enumeration (AC:L), but a valid low-privilege authenticated account is required (PR:L); freezing stock yields partial integrity/availability impact and no confidentiality loss.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
DescriptionCVE.org
Open WES through 1.0.0 contains an authorization bypass vulnerability that allows authenticated users to modify other warehouses' stock records because GlobalGatewayFilter never enforces auth_warehouse scoping. Attackers holding the menu permission can enumerate sequential IDs on freezeContainerStock and unfreezeContainerStock endpoints to freeze or unfreeze container stock in other warehouses.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB