Forced Browsing Vulnerability in Apache OFBiz Order Component
CVE-2026-114235

Currently unrated

Key Information:

Vendor

Apache
Status
Apache Ofbiz
Vendor
CVE Published:
5 November 2026

What is CVE-2026-114235?

A vulnerability exists in the Order component of Apache OFBiz prior to version 24.09.08 that allows an authenticated user with view-only access to manipulate the shipment tracking number for any order. This can be exploited by sending a direct request to the updateTrackingNumber endpoint, resulting in unauthorized changes. It is strongly advised to upgrade to version 24.09.08 to mitigate this risk.

Affected Version(s)

Apache OFBiz 0 < 24.09.08

References

https://lists.apache.org/thread.html/7b2syzksp7klt9fvhdg0...
vendor-advisory

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

noah (VNCS)
.