CVE-2026-111721
Received Received - Intake

Authorization Bypass in Open WES Warehouse Stock Records

Publication date: 2026-10-16

Last updated on: 2026-10-16

Assigner: VulnCheck

Description
Open WES through 1.0.0 contains an authorization bypass vulnerability that allows authenticated users to modify other warehouses' stock records because GlobalGatewayFilter never enforces auth_warehouse scoping. Attackers holding the menu permission can enumerate sequential IDs on freezeContainerStock and unfreezeContainerStock endpoints to freeze or unfreeze container stock in other warehouses.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-16
Last Modified
2026-10-16
Generated
2026-10-16
AI Q&A
2026-10-16
EPSS Evaluated
N/A
NVD
CVE-2026-111721
EUVD
EUVD-2026-103013

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
jingsewu open-wes 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Open WES through 1.0.0 has an authorization bypass flaw where authenticated users with menu permission can modify stock records of other warehouses. This happens because the GlobalGatewayFilter does not enforce warehouse-specific scoping (auth_warehouse), allowing attackers to freeze or unfreeze container stock in different warehouses by guessing sequential IDs on specific endpoints.

Detection Guidance

To detect this vulnerability, monitor API endpoints related to freezeContainerStock and unfreezeContainerStock for unauthorized access attempts. Check logs for sequential ID enumeration or requests from users with menu permission accessing other warehouses' stock records.

Impact Analysis

If you use Open WES 1.0.0 or earlier, attackers with menu access could freeze or unfreeze container stock in warehouses they don't own. This could disrupt inventory management, cause stock discrepancies, or lead to financial losses due to incorrect stock visibility.

Compliance Impact

This vulnerability may impact compliance with data integrity and access control requirements in GDPR (Article 32) and HIPAA (Security Rule). Unauthorized stock modifications could lead to inaccurate records, violating integrity principles and potentially exposing sensitive inventory data.

Mitigation Strategies

Immediately update Open WES to a patched version. Restrict menu permission access to only necessary users. Implement stricter authorization checks on freezeContainerStock and unfreezeContainerStock endpoints to enforce auth_warehouse scoping.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-111721. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart