Incorrect Privilege Assignment in Order Manager of Apache OFBiz

CVE-2026-114233

What is CVE-2026-114233?

A vulnerability exists in the Order Manager component of Apache OFBiz 24.09 prior to version 24.09.08, where an authenticated user with basic order view permissions can exploit incorrect privilege assignments. This allows them to modify approved orders, specifically altering shipping addresses and methods, or appending items at overridden prices through vulnerable services. It is strongly advised for users to update to version 24.09.08 to mitigate these risks.

References