Live › vulnerability › CVE-2026-111721
Go to dashboardOpen WES through 1.0.0 fails to enforce warehouse scoping in GlobalGatewayFilter, so a logged-in user can call the freezeContainerStock and unfreezeContainerStock endpoints. By enumerating sequential IDs, an attacker can freeze or unfreeze stock belonging to other warehouses.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Deployments of Open WES through 1.0.0 with more than one warehouse, where some users hold the menu permission that reaches the freeze and unfreeze endpoints. Single-warehouse installs and users without that permission are less exposed. The sources do not name a fixed version.
No product ranges from the sources yet.
1.0.0 are affected.freezeContainerStock and unfreezeContainerStock across warehouses.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Open WES through 1.0.0 contains an authorization bypass vulnerability that allows authenticated users to modify other warehouses' stock records because GlobalGatewayFilter never enforces auth_warehouse scoping. Attackers holding the menu permission can enumerate sequential IDs on freezeContainerStock and unfreezeContainerStock endpoints to freeze or unfreeze container stock in other warehouses.
This page as .md · .json · in your agent: get_signal("CVE-2026-111721")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.