Permission Bypass Vulnerability in Order Management Component by Apache
CVE-2026-105461

Currently unrated

Key Information:

Vendor: Apache
Status: Apache Ofbiz
Vendor: CVE Published:; 5 November 2026

What is CVE-2026-105461?

A security issue exists in the Apache Order Management Component where a missing check for the ORDERMGR_UPDATE permission allows users with only the ORDERMGR_VIEW permission to update orders. This flaw can lead to unauthorized modifications of order data. To mitigate this vulnerability, users are strongly advised to upgrade to version 24.09.08 or later.

Affected Version(s)

Apache OFBiz 0 < 24.09.08

References

https://lists.apache.org/thread.html/7b2syzksp7klt9fvhdg0...

vendor-advisory

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
Nov 5, 2026
Vulnerability Reserved
Oct 5, 2026

Credit

Ivan "Steph" Iushkevich

CVE-2026-105461 Data

JSON