Authorization Bypass in Open WES by Jingsewu
CVE-2026-111721

5.3MEDIUM

Key Information:

Vendor

Jingsewu

Status
Open-wes
Vendor
CVE Published:
16 October 2026

What is CVE-2026-111721?

Open WES versions up to 1.0.0 are susceptible to an authorization bypass issue that permits authenticated users to alter stock records across different warehouses. This flaw arises from the GlobalGatewayFilter, which fails to enforce proper authorization based on warehouse scope. An attacker possessing menu permissions can exploit this vulnerability by sequentially enumerating IDs on both the freezeContainerStock and unfreezeContainerStock endpoints, thereby gaining unauthorized control over container stock in other warehouses.

Affected Version(s)

open-wes 0 <= 1.0.0

References

https://hackmd.io/@hieuPenguinnn/open-wes-gateway-missing...
third-party-advisory
https://github.com/jingsewu/open-wes/blob/v1.0.0/server/m...
technical-description
https://github.com/jingsewu/open-wes/blob/v1.0.0/server/m...
technical-description

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

hieuPenguinnn
.