Description

A vulnerability was determined in OpenBoxes up to 0.9.7. This affects the function needManager of the file grails-app/controllers/org/pih/warehouse/RoleInterceptor.groovy of the component Role Interceptor. Executing a manipulation can lead to improper privilege management. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. Upgrading to version 0.9.8-hotfix1 and 0.9.8 mitigates this issue. This patch is called 788cace0af816aa972a713a4631c57f16f895e6b. Upgrading the affected component is recommended.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.3",
  "pubDate": "2026-08-16T03:16:50.143Z",
  "pubdate": "2026-08-16T03:16:50.143Z",
  "executiveSummary": "An improper privilege management vulnerability has been identified in OpenBoxes up to version 0.9.7, specifically within the Role Interceptor component. The flaw resides in the needManager function located in grails-app/controllers/org/pih/warehouse/RoleInterceptor.groovy. This security defect allows remote attackers to manipulate access controls, potentially bypassing intended authorization boundaries and leading to improper privilege management. The risk implication is significant as it compromises the role-based access control enforcement of the supply chain management platform. The attack can be executed remotely over the network without requiring complex preliminary interactions, provided the attacker leverages the publicly disclosed exploit. Mitigation requires upgrading the affected OpenBoxes installations to version 0.9.8, version 0.9.8-hotfix1, or applying the official patch referenced by the commit hash 788cace0af816aa972a713a4631c57f16f895e6b.",
  "technicalDetails": "The vulnerability exists due to flawed authorization and privilege validation logic implemented within the needManager function of the Role Interceptor component in OpenBoxes. Specifically, the file grails-app/controllers/org/pih/warehouse/RoleInterceptor.groovy fails to properly verify or enforce the necessary administrative or managerial role constraints during request interception phases.\nThe vulnerable component, Role Interceptor, is responsible for intercepting HTTP requests in the Grails framework to ensure that users attempting to access specific controller actions possess the appropriate security roles or privileges. Due to the improper privilege management implementation in needManager, the interceptor fails to correctly evaluate the session context or role hierarchy, allowing unauthorized or lower-privileged remote actors to bypass intended security checks.\nExploitation of this vulnerability occurs remotely over the network. An attacker crafts malicious or unauthorized HTTP requests targeting protected endpoints governed by the Role Interceptor. Because the needManager function improperly handles the validation logic, the request proceeds past the interception layer without enforcing the required manager-level privileges. This permits unauthorized execution of restricted controller actions and access to sensitive functionality reserved for higher-privileged roles.\nThe affected software versions include OpenBoxes up to version 0.9.7. The root cause stems from logic errors in how access control decisions are computed and enforced within the Groovy-based interceptor script. Successful exploitation leads to unauthorized privilege escalation and improper access control enforcement within the application context."
}