CVE-2026-19928
Received Received - Intake

Improper Privilege Management in OpenBoxes

Publication date: 2026-08-16

Last updated on: 2026-08-16

Assigner: VulDB

Description
A vulnerability was determined in OpenBoxes up to 0.9.7. This affects the function needManager of the file grails-app/controllers/org/pih/warehouse/RoleInterceptor.groovy of the component Role Interceptor. Executing a manipulation can lead to improper privilege management. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. Upgrading to version 0.9.8-hotfix1 and 0.9.8 mitigates this issue. This patch is called 788cace0af816aa972a713a4631c57f16f895e6b. Upgrading the affected component is recommended.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-16
Last Modified
2026-08-16
Generated
2026-08-16
AI Q&A
2026-08-16
EPSS Evaluated
N/A
NVD
CVE-2026-19928
EUVD
EUVD-2026-59844

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
openboxes openboxes to 0.9.8 (exc)
openboxes openboxes From 0.9.8 (inc)
openboxes openboxes From 0.9.8-hotfix1 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-269 The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
CWE-266 A product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-19928 is a privilege escalation vulnerability in OpenBoxes up to version 0.9.7. It allows users with Manager-level access to escalate their privileges to Admin by creating new user accounts and assigning them the Admin role. This occurs because the system fails to validate role assignments properly and incorrectly classifies user management endpoints under Manager-level permissions instead of Admin-level.

Detection Guidance

To detect this vulnerability, check if your OpenBoxes instance is running version 0.9.7 or earlier. Verify if the RoleInterceptor.groovy file contains improper privilege management logic. Inspect user management endpoints for Manager-role users who can assign Admin roles.

Impact Analysis

An attacker with Manager access could escalate to Admin, gaining full control over the system. This includes creating persistent backdoor admin accounts, accessing all user data and settings, compromising other accounts, manipulating inventory records, and disrupting services. The attack can be performed remotely and has been publicly disclosed.

Compliance Impact

This vulnerability could lead to compliance violations under GDPR and HIPAA due to unauthorized access to sensitive healthcare supply chain data, potential data breaches, and lack of proper access controls. Exploitation may result in unauthorized data exposure, integrity issues, and service disruptions affecting regulated operations.

Mitigation Strategies

Upgrade OpenBoxes to version 0.9.8 or 0.9.8-hotfix1 immediately. Apply the patch commit 788cace0af816aa972a713a4631c57f16f895e6b. Review and restrict Manager-role users' access to user management endpoints. Ensure role assignments are validated at the service layer.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-19928. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart