{"id":"CVE-2026-111721","kind":"vulnerability","aliases":["CVE-2026-111721"],"related":[],"title":"Open WES: authenticated users can freeze other warehouses' container stock","description":"Open WES through 1.0.0 contains an authorization bypass vulnerability that allows authenticated users to modify other warehouses' stock records because GlobalGatewayFilter never enforces auth_warehouse scoping. Attackers holding the menu permission can enumerate sequential IDs on freezeContainerStock and unfreezeContainerStock endpoints to freeze or unfreeze container stock in other warehouses.","summary":"Open WES through 1.0.0 fails to enforce warehouse scoping in GlobalGatewayFilter, so a logged-in user can call the freezeContainerStock and unfreezeContainerStock endpoints. By enumerating sequential IDs, an attacker can freeze or unfreeze stock belonging to other warehouses.","severity":"medium","cvss":5.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["multi-tenant","open-wes","other","warehouse-management"],"not_affected_if":["no-menu-permission-granted","single-warehouse"],"how_to_check":"- Check the installed Open WES version with the project's version file or package manifest; the sources say versions through `1.0.0` are affected.\n- Review whether users holding the menu permission can reach `freezeContainerStock` and `unfreezeContainerStock` across warehouses.","fix":"- unknown","status":"open","published_at":"2026-10-16T18:17:56+00:00","first_seen_at":"2026-10-23T21:57:14+00:00","triaged_at":"2026-10-25T04:18:16+00:00","updated_at":"2026-10-25T04:18:16+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-10-25T04:18:16Z","model":"claude-haiku-5-5","output":{"fix":"- unknown","reach":"network","title":"Open WES: authenticated users can freeze other warehouses' container stock","impact":"medium","summary":"Open WES through 1.0.0 fails to enforce warehouse scoping in GlobalGatewayFilter, so a logged-in user can call the freezeContainerStock and unfreezeContainerStock endpoints. By enumerating sequential IDs, an attacker can freeze or unfreeze stock belonging to other warehouses.","category":"other","nicknames":[],"who_cares":["open-wes","warehouse-management","multi-tenant"],"confidence":0.6,"needs_auth":"yes","worst_case":"Authenticated user alters stock freezes in other warehouses","analyst_note":"Find the upstream advisory or patched release for Open WES after 1.0.0 to confirm the fixed version and workaround.","how_to_check":"- Check the installed Open WES version with the project's version file or package manifest; the sources say versions through `1.0.0` are affected.\n- Review whether users holding the menu permission can reach `freezeContainerStock` and `unfreezeContainerStock` across warehouses.","needs_analyst":true,"not_affected_if":["single-warehouse","no-menu-permission-granted"],"who_is_affected":"Deployments of Open WES through 1.0.0 with more than one warehouse, where some users hold the menu permission that reaches the freeze and unfreeze endpoints. Single-warehouse installs and users without that permission are less exposed. The sources do not name a fixed version.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.00062,"input_tokens":3357,"output_tokens":568,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-111721':13A,16A '-2026':12A,15A '1.0.0':30B,69C 'allow':76C 'attack':56B,92C 'auth':89C 'authent':3A,77C 'author':72C 'belong':62B 'bypass':73C 'call':45B 'contain':9A,70C,110C 'cve':11A,14A 'endpoint':50B,105C 'enforc':33B,88C 'enumer':52B,98C 'fail':31B 'freez':6A,58B,107C 'freezecontainerstock':47B,102C 'globalgatewayfilt':37B,86C 'hold':93C 'id':54B,100C 'log':41B 'logged-in':40B 'manag':26B 'menu':95C 'modifi':80C 'multi':18B 'multi-ten':17B 'never':87C 'open':1A,21B,27B,66C 'open-w':20B 'permiss':96C 'record':84C 'scope':35B,91C 'sequenti':53B,99C 'stock':10A,61B,83C,111C 'tenant':19B 'unfreez':60B,109C 'unfreezecontainerstock':49B,104C 'user':4A,43B,78C 'vulner':74C 'warehous':8A,25B,34B,65B,82C,90C,114C 'warehouse-manag':24B 'wes':2A,22B,28B,67C","nicknames":[],"mitigations":[],"who_affected":"Deployments of Open WES through 1.0.0 with more than one warehouse, where some users hold the menu permission that reaches the freeze and unfreeze endpoints. Single-warehouse installs and users without that permission are less exposed. The sources do not name a fixed version.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-16T18:17:56+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111721","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111721","severity":null,"published_at":"2026-10-16T18:17:56+00:00","modified_at":"2026-10-16T22:17:23+00:00","first_seen_at":"2026-10-23T21:57:14+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}