Apache OFBiz: Incorrect Privilege Assignment in Order Manager Enables Unauthorized Modification of Approved Orders
Summary
| CVE | CVE-2026-114233 |
|---|---|
| State | PUBLISHED |
| Assigner | apache |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-11-05 14:17:00 UTC |
| Updated | 2026-11-05 14:48:26 UTC |
| Description | Incorrect Privilege Assignment in the Order Manager in Apache OFBiz 24.09 before 24.09.08 on all platforms allows an authenticated user who holds only order view permissions (ORDERMGR_VIEW), without ORDERMGR_UPDATE or any role on the order, to modify approved orders, changing a ship group's shipping address and shipment method or appending items with an overridden price, via the updateShipGroupShipInfo and appendOrderItem services. Users are recommended to upgrade to version 24.09.08, which fixes this issue. |
Risk And Classification
Problem Types: CWE-266 | CWE-266 CWE-266 Incorrect privilege assignment
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | Apache Software Foundation | Apache OFBiz | affected 24.09.08 semver | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| lists.apache.org/thread.html/7b2syzksp7klt9fvhdg0olldvs2g83lz | [email protected] | lists.apache.org | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
Vendor Comments And Credit
Discovery Credit
CNA: Javier García Herrera of Muted Cybersecurity (en)
There are currently no legacy QID mappings associated with this CVE.