Open WES through 1.0.0 Broken Access Control via GlobalGatewayFilter Warehouse Scoping
Open WES through 1.0.0 contains an authorization bypass vulnerability that allows authenticated users to modify other warehouses' stock records because GlobalGatewayFilter never enforces auth_warehouse scoping. Attackers holding the menu permission can enumerate sequential IDs on freezeContainerStock and unfreezeContainerStock endpoints to freeze or unfreeze container stock in other warehouses.
CVE-2026-111721
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-111721
open-wes
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"repo": "https://github.com/jingsewu/open-wes",
"vendor": "jingsewu",
"product": "open-wes",
"versions": [
{
"status": "affected",
"version": "0",
"versionType": "custom",
"lessThanOrEqual": "1.0.0"
}
],
"packageURL": "pkg:github/jingsewu/open-wes",
"defaultStatus": "unaffected"
}
]- Related CVEs
- CVE-2026-111721
Source reference:
/cveMetadata/cveId
Publisher severity
medium
Source reference: /containers/cna/metrics
- Event
- #34449 · Revision 1
- Added to Heist Feed
- Publisher date