EUVD-2026-59844
GHSA-22xp-gmqf-mrv3
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable web endpoint requires a low-privileged authenticated account (PR:L); role escalation is scoped within the same application (S:U); no availability impact described.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
5DescriptionCVE.org
A vulnerability was determined in OpenBoxes up to 0.9.7. This affects the function needManager of the file grails-app/controllers/org/pih/warehouse/RoleInterceptor.groovy of the component Role Interceptor. Executing a manipulation can lead to improper privilege management. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. Upgrading to version 0.9.8-hotfix1 and 0.9.8 mitigates this issue. This patch is called 788cace0af816aa972a713a4631c57f16f895e6b. Upgrading the affected component is recommended.
AnalysisAI
Improper privilege management in OpenBoxes up to 0.9.7 allows authenticated low-privileged users to escalate their roles by injecting unsanitized role parameters into the UserController's GORM data binding layer. The RoleInterceptor's needManager function additionally failed to enforce manager-level access on the user/show and user/edit endpoints, compounding the access control gap. A public proof-of-concept exploit is available; patched releases 0.9.8-hotfix1 and 0.9.8 are confirmed available from the vendor.
Technical ContextAI
OpenBoxes is a Grails-based open-source supply chain management platform used in humanitarian and healthcare logistics. The vulnerability spans two components. First, RoleInterceptor.groovy maintains an allow-list of controller actions that require manager-level privileges; in affected versions, the 'user/show' and 'user/edit' actions were absent from this list, meaning authenticated users of any role could access them. Second, UserController.groovy passed raw HTTP request parameters (including role-assignment keys like 'roles' and 'roles[0].id') directly into GORM's data binding when creating or updating users, without first extracting and separately validating those parameters through an authorization check. The fix (commit 788cace0af816aa972a713a4631c57f16f895e6b) adds 'user/show' and 'user/edit' to the manager-required list and introduces a popRoleParamsBeforeBinding helper that strips role params from the binding map and passes them separately to userService for authorization validation, with the session user's ID used to verify that the requesting user is permitted to assign those roles. CWE-269 (Improper Privilege Management) precisely describes this root cause: the system lacked enforcement of privilege constraints at the parameter binding boundary. CPE: cpe:2.3:a:n/a:openboxes:*:*:*:*:*:*:*:*.
RemediationAI
Upgrade OpenBoxes to version 0.9.8 or 0.9.8-hotfix1, which contain the complete fix via commit 788cace0af816aa972a713a4631c57f16f895e6b (PR #5948). Release artifacts are available at https://github.com/openboxes/openboxes/releases/tag/v0.9.8. If an immediate upgrade is not feasible, restrict access to the /user/show, /user/edit, /user/list, /user/create, and related user management endpoints at the reverse proxy or firewall layer to IP ranges exclusively used by verified administrators - this reduces external attack surface but does not eliminate the underlying authorization flaw for insider-threat scenarios. Following remediation or as a parallel investigative step, audit all user accounts for unexpected role assignments made since the instance was deployed, as prior exploitation would leave elevated accounts in place.
LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutContr
Reachable assertion in Open5GS up to version 2.7.6 allows remote unauthenticated attackers to crash the Diameter CER han
A Command Injection issue in the payload build page in BYOB (Build Your Own Botnet) 2.0 allows attackers to execute arbi
Denial of service in Open5GS 2.7.6 and earlier allows network-adjacent attackers with low-privilege Diameter Gx peer acc
Denial of service in Open5GS HSS (Home Subscriber Server) versions 2.7.0 through 2.7.6 is triggered remotely by manipula
Remote command injection in Control Web Panel allows unauthenticated attackers to execute arbitrary OS commands as root
LINQPad before 5.52.01 Pro edition is vulnerable to Unsafe Deserialization in LINQPad.AutoRefManager::PopulateFromCache(
Remote code execution in dash-uploader (Python package for Plotly Dash) versions 0.1.0 through 0.7.0a2 allows unauthenti
Command injection in LiteLLM 1.18.10 lets attackers who can configure MCP (Model Context Protocol) servers supply arbitr
SQL injection in AzuraCast's backup restore flow (versions up to and including 0.23.7) lets an attacker achieve privileg
Arbitrary file read in Yu AI Code Mother v4.3 lets anonymous, remote attackers retrieve files outside the intended previ
Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali
Same weakness CWE-269 – Improper Privilege Management
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today