Authorization Bypass Vulnerability in Apache OFBiz by Apache
CVE-2026-109837

Currently unrated

Key Information:

Vendor: Apache
Status: Apache Ofbiz
Vendor: CVE Published:; 5 November 2026

What is CVE-2026-109837?

An authorization bypass vulnerability exists in Apache OFBiz prior to version 24.09.08, allowing authenticated users with low-privileged Order Manager access to manipulate order items. Specifically, affected users can associate any OrderItem with a ReturnItem using the createReturnItem service, posing a potential risk of unauthorized access and data integrity issues. It is critical for users to upgrade to version 24.09.08 or later to remediate this vulnerability.

Affected Version(s)

Apache OFBiz 0 < 24.09.08

References

https://lists.apache.org/thread.html/7b2syzksp7klt9fvhdg0...

vendor-advisory

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
Nov 5, 2026
Vulnerability Reserved
Oct 13, 2026

Credit

Omar Mousa — Red Team & Security Researcher, LinkedIn: https://www.linkedin.com/in/omar-mousa15

CVE-2026-109837 Data

JSON