Skip to content
CVE PROGRAM SOURCE RECORD5.3 Medium

CVE-2026-19928

OpenBoxes Role Interceptor RoleInterceptor.groovy needManager privileges management

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
VulDB

Description

A vulnerability was determined in OpenBoxes up to 0.9.7. This affects the function needManager of the file grails-app/controllers/org/pih/warehouse/RoleInterceptor.groovy of the component Role Interceptor. Executing a manipulation can lead to improper privilege management. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. Upgrading to version 0.9.8-hotfix1 and 0.9.8 mitigates this issue. This patch is called 788cace0af816aa972a713a4631c57f16f895e6b. Upgrading the affected component is recommended.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

n/a OpenBoxes

  • 0.9.0affected
  • 0.9.1affected
  • 0.9.2affected
  • 0.9.3affected
  • 0.9.4affected
  • 0.9.5affected
  • 0.9.6affected
  • 0.9.7affected
  • 0.9.8-hotfix1unaffected
  • 0.9.8unaffected

References