CVE-2026-19928: Improper Privilege Management in OpenBoxes
CVE-2026-19928 is a medium severity vulnerability in OpenBoxes up to version 0.9.7 involving improper privilege management in the Role Interceptor component. The flaw exists in the needManager function of the RoleInterceptor.groovy file and can be exploited remotely without user interaction. Public exploit details have been disclosed. Upgrading to versions 0.9.8 or 0.9.8-hotfix1 resolves the issue.
AI Analysis
Technical Summary
This vulnerability affects OpenBoxes versions 0.9.0 through 0.9.7 in the Role Interceptor component, specifically the needManager function in grails-app/controllers/org/pih/warehouse/RoleInterceptor.groovy. Improper privilege management allows an attacker to manipulate privileges remotely. The vulnerability has a CVSS 4.0 base score of 5.3 (medium severity) and has been publicly disclosed. The issue is fixed in OpenBoxes versions 0.9.8 and 0.9.8-hotfix1, with the patch identified by commit 788cace0af816aa972a713a4631c57f16f895e6b.
Potential Impact
An attacker can remotely exploit this vulnerability to improperly manage privileges within the OpenBoxes application, potentially gaining unauthorized access or elevated permissions. The impact is limited to privilege mismanagement and does not indicate direct code execution or data disclosure. The vulnerability has been publicly disclosed but no known exploits in the wild have been reported.
Mitigation Recommendations
Upgrade OpenBoxes to version 0.9.8 or 0.9.8-hotfix1 to apply the official fix for this vulnerability. This upgrade addresses the improper privilege management issue in the Role Interceptor component. No additional mitigations are specified or required beyond applying the patch.
CVE-2026-19928: Improper Privilege Management in OpenBoxes
Description
CVE-2026-19928 is a medium severity vulnerability in OpenBoxes up to version 0.9.7 involving improper privilege management in the Role Interceptor component. The flaw exists in the needManager function of the RoleInterceptor.groovy file and can be exploited remotely without user interaction. Public exploit details have been disclosed. Upgrading to versions 0.9.8 or 0.9.8-hotfix1 resolves the issue.
CVSS v4.0
Score 5.3medium
Affected software
pkg:github/openboxes/openboxescpe:2.3:a:openboxes:openboxes:*:*:*:*:*:*:*:*Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability affects OpenBoxes versions 0.9.0 through 0.9.7 in the Role Interceptor component, specifically the needManager function in grails-app/controllers/org/pih/warehouse/RoleInterceptor.groovy. Improper privilege management allows an attacker to manipulate privileges remotely. The vulnerability has a CVSS 4.0 base score of 5.3 (medium severity) and has been publicly disclosed. The issue is fixed in OpenBoxes versions 0.9.8 and 0.9.8-hotfix1, with the patch identified by commit 788cace0af816aa972a713a4631c57f16f895e6b.
Potential Impact
An attacker can remotely exploit this vulnerability to improperly manage privileges within the OpenBoxes application, potentially gaining unauthorized access or elevated permissions. The impact is limited to privilege mismanagement and does not indicate direct code execution or data disclosure. The vulnerability has been publicly disclosed but no known exploits in the wild have been reported.
Mitigation Recommendations
Upgrade OpenBoxes to version 0.9.8 or 0.9.8-hotfix1 to apply the official fix for this vulnerability. This upgrade addresses the improper privilege management issue in the Role Interceptor component. No additional mitigations are specified or required beyond applying the patch.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulDB
- Date Reserved
- 2026-08-15T05:46:50.788Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a8126f8bf8831d539522442
Added to database: 08/16/2026, 02:56:56 UTC
Last enriched: 08/16/2026, 03:13:44 UTC
Last updated: 08/16/2026, 03:27:42 UTC
Views: 6
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.