CVE-2024-14045

OpenBoxes Product Supplier Edit Controller RoleInterceptor.groovy improper authorization

State: Published
Severity: 5.3 Medium
Published: Aug 18, 2026
Updated: Aug 18, 2026
Reserved: Aug 16, 2026

Description

A weakness has been identified in OpenBoxes up to 0.9.2. This vulnerability affects unknown code of the file grails-app/controllers/org/pih/warehouse/RoleInterceptor.groovy of the component Product Supplier Edit Controller. Executing a manipulation can lead to improper authorization. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks. Upgrading to version 0.9.3 is able to resolve this issue. This patch is called f767ac1a5987d4865d9f158c6a967680f8e45468. It is suggested to upgrade the affected component.

Scores

CVSS	Score	Vector	Source
4.0	5.3 Medium	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P	VulDB
3.1	6.3 Medium	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C	VulDB
3.0	6.3 Medium	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C	VulDB
2.0	6.5 Medium	AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:OF/RC:C	VulDB

Weaknesses

CWE-285 Improper Authorization
CWE-266 Incorrect Privilege Assignment

Affected Products

Product	Versions
OpenBoxesn/a	0.9.0Affected 0.9.1Affected 0.9.2Affected 0.9.3Not affected

References

VDB-391109 | OpenBoxes Product Supplier Edit Controller RoleInterceptor.groovy improper authorizationvdb-entry
VDB-391109 | CTI Indicators (IOB, IOC, TTP, IOA)signaturepermissions-required
CVE-2024-14045 | CVE Analysis and Reportthird-party-advisory
Submit #872700 | Openboxes < v0.9.3 Missing Authorizationthird-party-advisory
https://gist.github.com/nedlir/22cf2f1e5dd337ebba12a1be6ee83150exploit
https://github.com/openboxes/openboxes/pull/4905issue-trackingpatch
https://github.com/openboxes/openboxes/commit/f767ac1a5987d4865d9f158c6a967680f8e45468patch
https://github.com/openboxes/openboxes/releases/tag/v0.9.3patch
https://github.com/openboxes/openboxes/product

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.