CVE-2026-105461None▾ SunlitMissing check for ORDERMGR_UPDATE in ordermgr allows user with only ORDERMGR_VIEW permission to update orders. Affected versions before : 24.09.08 Users are recommended to upgrade to version 24.09.08 which fixes this issue.
▾ Sunlit zone — Low / medium · no exploitation signal
impact 2.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Missing check for ORDERMGR_UPDATE in ordermgr allows user with only ORDERMGR_VIEW permission to update orders.
Affected versions before : 24.09.08
Users are recommended to upgrade to version 24.09.08 which fixes this issue.
apache_ofbiz < 24.09.08Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-85627NoneApache OFBiz: Authenticated Code Execution Vulnerability
CVE-2026-100168NoneApache OFBiz: Missing Authorization vulnerability
CVE-2026-105325NoneApache OFBiz: Missing authorization in payment application services allows view-only users to modify payment allocations
CVE-2026-109856NoneApache OFBiz: Missing Authorization in Financial Account Services Enables Unauthorized Balance Manipulation
CVE-2026-114235NoneApache OFBiz: Direct Request in Order Manager Enables Unauthorized Tracking Number Modification
CVE-2026-66903Medium· 6.5Apache OFBiz: Authenticated Path Traversal in Catalog Image Management