Skip to content
OpenAdvisories
High · 7.5 CVE-2026-105461 EUVD-2026-117523GHSA-vr6p-72w4-fx5w

Apache OFBiz: Missing authorization in updateOrderItems allows view-only users to modify order prices and quantities

Published Nov 5, 2026 · Updated Nov 10, 2026 · Assigned by apache

Vendor: Apache Software Foundation Product: Apache OFBiz

Description

Missing check for  ORDERMGR_UPDATE in ordermgr allows user with only ORDERMGR_VIEW permission to update orders.

Affected versions before : 24.09.08

Users are recommended to upgrade to version 24.09.08 which fixes this issue.

Affected products

VendorProductAffectedFixed
Apache Software Foundation Apache OFBiz < 24.09.08 24.09.08

Advisories 1

References