Authorization Bypass Vulnerability in Apache OFBiz Order Manager Component
CVE-2026-109129

Currently unrated

Key Information:

Vendor

Apache
Status
Apache Ofbiz
Vendor
CVE Published:
5 November 2026

What is CVE-2026-109129?

An authorization bypass vulnerability exists in the Order Manager component of Apache OFBiz version 24.09.07, affecting all platforms. This flaw allows authenticated users with mere view-level order permissions to illicitly modify or create 'OrderPaymentPreference' records tied to orders beyond their assigned access. By exploiting the 'updateOrderPaymentPreference' service, an attacker can provide an 'orderPaymentPreferenceId' linked to a different order, circumventing established permission controls. Users are advised to update to version 24.09.08 to mitigate this risk.

Affected Version(s)

Apache OFBiz 0 < 24.09.08

References

https://lists.apache.org/thread.html/7b2syzksp7klt9fvhdg0...
vendor-advisory

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Omar Mousa — Red Team & Security Researcher, LinkedIn: https://www.linkedin.com/in/omar-mousa15
.