Description

A weakness has been identified in OpenBoxes up to 0.9.2. This vulnerability affects unknown code of the file grails-app/controllers/org/pih/warehouse/RoleInterceptor.groovy of the component Product Supplier Edit Controller. Executing a manipulation can lead to improper authorization. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks. Upgrading to version 0.9.3 is able to resolve this issue. This patch is called f767ac1a5987d4865d9f158c6a967680f8e45468. It is suggested to upgrade the affected component.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.3",
  "pubDate": "2026-08-18T09:16:45.447Z",
  "pubdate": "2026-08-18T09:16:45.447Z",
  "executiveSummary": "An improper authorization vulnerability has been identified in OpenBoxes up to version 0.9.2, specifically within the Product Supplier Edit Controller component. The flaw stems from insufficient access control enforcement managed by the underlying RoleInterceptor.groovy file. This security deficit allows remote unauthenticated or low-privileged attackers to bypass intended security boundaries and perform unauthorized manipulations against sensitive product supplier management functions. Successful exploitation of this vulnerability can lead to unauthorized modification, creation, or deletion of critical supply chain data within the application context, posing significant integrity and operational risks to deployment environments. Because public exploits targeting this flaw have been made publicly available, the attack surface is exposed to immediate automated and targeted exploitation attempts from remote network perimeters. Mitigating this risk requires immediate administrative action to remediate the affected software component through official vendor-supplied patches, as inadequate authorization checks remain a critical enterprise risk vector.",
  "technicalDetails": "The vulnerability resides within the OpenBoxes application, specifically affecting the controller logic linked to the Product Supplier Edit Controller component. The architectural root cause is rooted in inadequate authorization enforcement implemented within the Grails interceptor class located at grails-app/controllers/org/pih/warehouse/RoleInterceptor.groovy. In Grails frameworks, interceptors are typically responsible for intercepting web requests prior to controller action execution to validate security constraints, session states, and role-based access control (RBAC) permissions. Due to flawed logic or missing route mappings within RoleInterceptor.groovy, the application fails to adequately validate whether the requesting remote actor possesses the requisite administrative roles or functional privileges required to access and manipulate product supplier endpoints.\nFrom an attack flow perspective, a remote adversary interacting with the network-exposed OpenBoxes instance can craft malicious HTTP requests directed at the Product Supplier Edit Controller functionalities. Because the RoleInterceptor fails to properly enforce access controls, the intercepted request bypasses validation checks and directly invokes the underlying controller actions. The attacker does not require specialized authentication credentials or elevated administrative privileges if the interceptor logic mistakenly permits general access or fails to evaluate the request context correctly.\nUpon successful traversal of the flawed interceptor, the application processes the incoming payload and executes state-changing operations within the product supplier management module. The post-exploitation impact includes unauthorized data tampering, supply chain data corruption, and potential privilege escalation logic abuse depending on how downstream services handle the unverified input. The flaw affects OpenBoxes versions up to and including 0.9.2, leaving all standard deployments exposed over remote network interfaces unless compensating security controls or patches are applied."
}