CVE-2024-14045

CVE-2024-14045 is a broken access control vulnerability in OpenBoxes' RoleInterceptor.groovy that allows unauthorized modification of supplier records through the ProductSupplierEditController. The CVSS score of 6.5 (Medium) captures the technical severity but fundamentally underrepresents the operational risk—this is a supply chain and inventory management platform, and corrupted supplier data can poison procurement workflows, introduce counterfeit sources, or create fraudulent audit trails that look legitimate because they originated through the "authorized" edit workflow. What makes this analytically significant is its location. RoleInterceptor.groovy operates at a cross-cutting layer above individual controllers—when this interceptor fails, the request silently proceeds to the controller, which then executes business logic assuming authorization was already enforced upstream. This is fundamentally different from a missing authorization check in a controller, which typically throws a 403 or returns an error. The silent bypass means the blast radius extends beyond the controller itself: it corrupts the entire set of operations the controller performs on data that downstream systems trust as legitimately authorized. The architectural implication is that fixing this likely requires more than adding a single authorization call. When security enforcement lives in a layer developers aren't actively thinking about during feature work, regressions become almost inevitable—someone modifies the interceptor for a different edge case, role definitions evolve, and the implicit authorization contract silently breaks. You should examine the patch commit (f767ac1a5987d4865d9f158c6a967680f8e45468) to determine whether it represents a targeted role mapping correction for ProductSupplierEditController or a broader correction to interceptor behavior. If it's the former, the architectural problem persists and other controllers under the same interceptor may be operating on fragile assumptions about role coverage. Check whether RoleInterceptor.groovy is used consistently across OpenBoxes. If authorization is enforced differently across different controllers, developers ship code without a consistent mental model—some add redundant checks, others assume interceptor coverage exists when it doesn't. Review the commit history for this interceptor to determine whether similar authorization failures have occurred before; if RoleInterceptor.groovy has prior security patches, this may be a recurring architectural vulnerability rather than an isolated incident. In either case, verify that 0.9.3 is deployed, but treat that as the starting point for an audit rather than the completion of remediation.

Reviewed through automated stages and approved by a human before publication.