Authorization Bypass in Apache OFBiz Shopping List Services

CVE-2026-114271

What is CVE-2026-114271?

An authorization bypass vulnerability exists in the shopping list services of Apache OFBiz version 24.09 prior to 24.09.08. This security weakness allows authenticated low-privileged users, such as self-registered e-commerce customers, to manipulate or take control of another user's shopping list. By sending crafted requests to the shopping list update endpoint, these users can exploit the system by supplying the target user's shopping list ID, thereby gaining unauthorized access to private contents. To mitigate this security risk, users are advised to upgrade to version 24.09.08, which addresses this flaw.

References