A vulnerability was determined in OpenBoxes up to 0.9.7. This affects the function needManager of the file grails-app/controllers/org/pih/warehouse/RoleInterceptor.groovy of the component Role Interceptor. Executing a manipulation can lead to improper privilege management.
The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. Upgrading to version 0.9.8-hotfix1 and 0.9.8 mitigates this issue.
This patch is called 788cace0af816aa972a713a4631c57f16f895e6b. Upgrading the affected component is recommended.
Attack Parameters
Attack Vector
Network
Can be exploited remotely
Attack Complexity
Low
Easy to exploit
Attack Requirements
None
No additional conditions
Privileges Required
Low
Basic privileges needed
User Interaction
None
No user interaction needed
Impact Assessment
Confidentiality
Low
Partial data leak
Integrity
Low
Partial data modification
Availability
Low
Partial disruption
CVSS Vector v4.0
Weakness Type (CWE)
References 10
https://gist.github.com/nedlir/2bc3a6e5bd4d67b863223e1bfc2e4390
cna@vuldb.com
https://github.com/OpenBoxes/OpenBoxes/
cna@vuldb.com
https://github.com/OpenBoxes/OpenBoxes/pull/5948
cna@vuldb.com
https://github.com/OpenBoxes/OpenBoxes/security/advisories/GHSA-9rrw-fx2p-p2q7
cna@vuldb.com
https://github.com/openboxes/openboxes/commit/788cace0af816aa972a713a4631c57f16…
cna@vuldb.com
https://github.com/openboxes/openboxes/releases/tag/v0.9.8
cna@vuldb.com
https://vuldb.com/cve/CVE-2026-19928
cna@vuldb.com
https://vuldb.com/submit/871981
cna@vuldb.com
https://vuldb.com/vuln/390179
cna@vuldb.com
https://vuldb.com/vuln/390179/cti
cna@vuldb.com