CVE-2026-19928: Improper Privilege Management in OpenBoxes
A vulnerability was determined in OpenBoxes up to 0.9.7. This affects the function needManager of the file grails-app/controllers/org/pih/warehouse/RoleInterceptor.groovy of the component Role Interceptor. Executing a manipulation can lead to improper privilege management. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. Upgrading to version 0.9.8-hotfix1 and 0.9.8 mitigates this issue. This patch is called 788cace0af816aa972a713a4631c57f16f895e6b. Upgrading the affected component is recommended.
AI Analysis
Technical Summary
This vulnerability affects the OpenBoxes software, specifically the needManager function in the RoleInterceptor.groovy file. It allows improper privilege management, potentially enabling unauthorized privilege escalation or access control bypass. The vulnerability is remotely exploitable without user interaction and has been publicly disclosed. The issue is fixed in OpenBoxes versions 0.9.8 and 0.9.8-hotfix1, with the patch identified by commit 788cace0af816aa972a713a4631c57f16f895e6b.
Potential Impact
An attacker can remotely exploit this vulnerability to manipulate privilege management, potentially gaining unauthorized access or elevated privileges within the OpenBoxes system. This could lead to unauthorized actions being performed by the attacker. The CVSS score of 5.3 indicates a medium impact with network attack vector, low complexity, and no user interaction required.
Mitigation Recommendations
Upgrade OpenBoxes to version 0.9.8 or 0.9.8-hotfix1 to apply the official fix for this vulnerability. This upgrade addresses the improper privilege management issue in the RoleInterceptor component. No additional mitigation steps are indicated by the vendor advisory.
CVE-2026-19928: Improper Privilege Management in OpenBoxes
Description
A vulnerability was determined in OpenBoxes up to 0.9.7. This affects the function needManager of the file grails-app/controllers/org/pih/warehouse/RoleInterceptor.groovy of the component Role Interceptor. Executing a manipulation can lead to improper privilege management. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. Upgrading to version 0.9.8-hotfix1 and 0.9.8 mitigates this issue. This patch is called 788cace0af816aa972a713a4631c57f16f895e6b. Upgrading the affected component is recommended.
CVSS v4.0
Score 5.3medium
Affected software
pkg:github/openboxes/OpenBoxesRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability affects the OpenBoxes software, specifically the needManager function in the RoleInterceptor.groovy file. It allows improper privilege management, potentially enabling unauthorized privilege escalation or access control bypass. The vulnerability is remotely exploitable without user interaction and has been publicly disclosed. The issue is fixed in OpenBoxes versions 0.9.8 and 0.9.8-hotfix1, with the patch identified by commit 788cace0af816aa972a713a4631c57f16f895e6b.
Potential Impact
An attacker can remotely exploit this vulnerability to manipulate privilege management, potentially gaining unauthorized access or elevated privileges within the OpenBoxes system. This could lead to unauthorized actions being performed by the attacker. The CVSS score of 5.3 indicates a medium impact with network attack vector, low complexity, and no user interaction required.
Mitigation Recommendations
Upgrade OpenBoxes to version 0.9.8 or 0.9.8-hotfix1 to apply the official fix for this vulnerability. This upgrade addresses the improper privilege management issue in the RoleInterceptor component. No additional mitigation steps are indicated by the vendor advisory.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-22xp-gmqf-mrv3
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-19928"]
- Database Specific Severity
- LOW
- Cvss Version
- 3.1
Threat ID: 6a81d703bf8831d5394a1063
Added to database: 08/16/2026, 15:28:03 UTC
Last enriched: 08/24/2026, 11:18:27 UTC
Last updated: 10/01/2026, 05:08:50 UTC
Views: 55
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.