Unauthorized Access Risk in Accounting Software from Vendor
CVE-2026-105325

Currently unrated

Key Information:

Vendor

Apache
Status
Apache Ofbiz
Vendor
CVE Published:
5 November 2026

What is CVE-2026-105325?

A security vulnerability has been identified in the accounting software that permits users with only the 'ACCOUNTING_VIEW' permission to update or create PaymentApplications. This oversight arises due to a missing validation check for the 'ACCOUNTING_UPDATE' and 'ACCOUNTING_CREATE' permissions. It is essential for users to upgrade to version 24.09.08 or later to mitigate this risk and ensure proper access controls are enforced.

Affected Version(s)

Apache OFBiz 0 < 24.09.08

References

https://lists.apache.org/thread.html/7b2syzksp7klt9fvhdg0...
vendor-advisory

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Ivan "Steph" Iushkevich
.