Direct Request Vulnerability in Apache OFBiz Financial Account Services
CVE-2026-109856

Currently unrated

Key Information:

Vendor

Apache
Status
Apache Ofbiz
Vendor
CVE Published:
5 November 2026

What is CVE-2026-109856?

A vulnerability in Apache OFBiz affects Financial Account services, permitting authenticated users with low-privilege accounts to exploit direct requests. This enables them to create, modify, and cancel financial transactions without proper authorization, compromising the integrity of account management. It is essential for users to upgrade to version 24.09.08 to resolve this issue and secure sensitive financial operations.

Affected Version(s)

Apache OFBiz 0 < 24.09.08

References

https://lists.apache.org/thread.html/7b2syzksp7klt9fvhdg0...
vendor-advisory

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Ho1aAs <xxy010605@gmail.com>
Mathias Conradt | Sonar
.