Open Wes
Monthly
Open WES through 1.0.0 does not enforce warehouse-scope authorization in GlobalGatewayFilter, so an authenticated user who holds the menu permission for the stock endpoints can freeze or unfreeze container stock belonging to any warehouse by enumerating sequential IDs on the freezeContainerStock and unfreezeContainerStock endpoints. This is a moderate-severity authorization bypass (CWE-639 IDOR; CVSS 5.3) with integrity and availability impact only, and no public exploit identified at time of analysis. Only installations up to and including version 1.0.0 are affected.
Open WES through 1.0.0 does not enforce warehouse-scope authorization in GlobalGatewayFilter, so an authenticated user who holds the menu permission for the stock endpoints can freeze or unfreeze container stock belonging to any warehouse by enumerating sequential IDs on the freezeContainerStock and unfreezeContainerStock endpoints. This is a moderate-severity authorization bypass (CWE-639 IDOR; CVSS 5.3) with integrity and availability impact only, and no public exploit identified at time of analysis. Only installations up to and including version 1.0.0 are affected.