CVE-2026-111721 jingsewu CVE debrief

Who should care

Defenders responsible for Open WES installations should assess exposure and prioritize patching. Roles include security teams, system administrators, and developers working with Open WES.

Why it matters

CVE-2026-111721 is a medium-severity vulnerability in Open WES, allowing authenticated users to modify stock records of other warehouses. Defenders should prioritize verifying and patching Open WES installations, focusing on restricting access to sensitive endpoints and ensuring proper authorization checks are in place.

• Authenticated users can modify stock records of other warehouses
• Potential for unauthorized access to sensitive data
• Need for verification of Open WES installations and patching

Technical summary

The vulnerability exists in Open WES through 1.0.0, where the GlobalGatewayFilter fails to enforce auth_warehouse scoping. This allows authenticated users with menu permissions to modify stock records of other warehouses by enumerating sequential IDs on freezeContainerStock and unfreezeContainerStock endpoints. The issue arises from inadequate authorization checks, potentially exposing sensitive data. Defenders should prioritize verifying and patching Open WES installations, focusing on restricting access to sensitive endpoints and ensuring proper authorization checks are in place.

Defensive priority

Defenders should prioritize verifying and patching Open WES installations, focusing on restricting access to sensitive endpoints and ensuring proper authorization checks are in place.

Recommended defensive actions

• Verify and apply patches for Open WES installations
• Restrict access to sensitive endpoints
• Ensure proper authorization checks are in place
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its description and CVSS score. However, the exact scope of affected versions and potential exploitation remains limited. Defenders should verify Open WES installations, focusing on restricting access to sensitive endpoints and ensuring proper authorization checks are in place. Evidence from GlobalGatewayFilter.java and ContainerStockController.java source references supports this assessment. Additional review of HackMD articles and other sources may provide

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.