Improper Input Validation in Order Returns in Apache OFBiz by Apache
CVE-2026-100228

Currently unrated

Key Information:

Vendor

Apache
Status
Apache Ofbiz
Vendor
CVE Published:
5 November 2026

What is CVE-2026-100228?

A flaw in the input validation process of the createReturnItem service in Apache OFBiz version 24.09.07 allows authenticated users without the ORDERMGR_CREATE permission to set arbitrary prices on returned items. This vulnerability permits a bypass of the server's computed price ceiling, leading to potential exploitation. Users are advised to upgrade to version 24.09.08 to mitigate this risk, ensuring that the integrity of the order return process is maintained.

Affected Version(s)

Apache OFBiz 0 < 24.09.08

References

https://lists.apache.org/thread.html/7b2syzksp7klt9fvhdg0...
vendor-advisory

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Sakil Ahamed
.