{"api_version":"1","generated_at":"2026-11-08T08:07:33+00:00","cve":"CVE-2026-114235","urls":{"html":"https://cve.report/CVE-2026-114235","api":"https://cve.report/api/cve/CVE-2026-114235.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-114235","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-114235"},"summary":{"title":"Apache OFBiz: Direct Request in Order Manager Enables Unauthorized Tracking Number Modification","description":"Direct Request ('Forced Browsing') in the Order component in Apache OFBiz 24.09 before 24.09.08 on all platforms allows an authenticated user with only view access to the Order Manager to modify the shipment tracking number of any order via a direct request to the updateTrackingNumber endpoint. Users are recommended to upgrade to version 24.09.08, which fixes this issue.","state":"PUBLISHED","assigner":"apache","published_at":"2026-11-05 14:17:00","updated_at":"2026-11-05 14:48:26"},"problem_types":["CWE-425","CWE-425 CWE-425 Direct request ('forced browsing')"],"metrics":[],"references":[{"url":"https://lists.apache.org/thread.html/7b2syzksp7klt9fvhdg0olldvs2g83lz","name":"https://lists.apache.org/thread.html/7b2syzksp7klt9fvhdg0olldvs2g83lz","refsource":"security@apache.org","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-114235","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114235","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Apache Software Foundation","product":"Apache OFBiz","version":"affected 24.09.08 semver","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[{"source":"CNA","value":"noah (VNCS)","lang":"en"}],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"cna":{"affected":[{"defaultStatus":"unaffected","product":"Apache OFBiz","vendor":"Apache Software Foundation","versions":[{"lessThan":"24.09.08","status":"affected","version":"0","versionType":"semver"}]}],"credits":[{"lang":"en","type":"reporter","value":"noah (VNCS)"}],"descriptions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"<div><span>Direct Request ('Forced Browsing') in the Order component in Apache OFBiz&nbsp;</span>24.09 before 24.09.08<span>&nbsp;on all platforms allows an authenticated user with only view access to the Order Manager to modify the shipment tracking number of any order via a direct request to the updateTrackingNumber endpoint. Users are recommended to upgrade to version&nbsp;</span>24.09.08<span>, which fixes this issue.</span></div>"}],"value":"Direct Request ('Forced Browsing') in the Order component in Apache OFBiz 24.09 before 24.09.08 on all platforms allows an authenticated user with only view access to the Order Manager to modify the shipment tracking number of any order via a direct request to the updateTrackingNumber endpoint. Users are recommended to upgrade to version 24.09.08, which fixes this issue."}],"metrics":[{"other":{"content":{"text":"moderate"},"type":"Textual description of severity"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-425","description":"CWE-425 Direct request ('forced browsing')","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-11-05T13:35:14.717Z","orgId":"f0158376-9dc2-43b6-827c-5f631a4d8d09","shortName":"apache"},"references":[{"tags":["vendor-advisory"],"url":"https://lists.apache.org/thread.html/7b2syzksp7klt9fvhdg0olldvs2g83lz"}],"source":{"discovery":"EXTERNAL"},"title":"Apache OFBiz: Direct Request in Order Manager Enables Unauthorized Tracking Number Modification","x_generator":{"engine":"Vulnogram 1.0.3"}}},"cveMetadata":{"assignerOrgId":"f0158376-9dc2-43b6-827c-5f631a4d8d09","assignerShortName":"apache","cveId":"CVE-2026-114235","datePublished":"2026-11-05T13:35:14.717Z","dateReserved":"2026-10-21T06:36:30.326Z","dateUpdated":"2026-11-05T13:35:14.717Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-11-05 14:17:00","lastModifiedDate":"2026-11-05 14:48:26","problem_types":["CWE-425","CWE-425 CWE-425 Direct request ('forced browsing')"],"metrics":[],"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"114235","Ordinal":"1","Title":"Apache OFBiz: Direct Request in Order Manager Enables Unauthoriz","CVE":"CVE-2026-114235","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"114235","Ordinal":"1","NoteData":"Direct Request ('Forced Browsing') in the Order component in Apache OFBiz 24.09 before 24.09.08 on all platforms allows an authenticated user with only view access to the Order Manager to modify the shipment tracking number of any order via a direct request to the updateTrackingNumber endpoint. Users are recommended to upgrade to version 24.09.08, which fixes this issue.","Type":"Description","Title":"Apache OFBiz: Direct Request in Order Manager Enables Unauthoriz"}]}}}