CVE-2026-109856None▾ SunlitDirect Request ('Forced Browsing') to Financial Account services in Apache OFBiz 24.09 before 24.09.08 on all platforms allows an authenticated user with any valid low-privilege account to create, modify, and cancel financial account tra…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 2.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Direct Request ('Forced Browsing') to Financial Account services in Apache OFBiz 24.09 before 24.09.08 on all platforms allows an authenticated user with any valid low-privilege account to create, modify, and cancel financial account transactions and balances without appropriate permission via direct requests to the createFinAccount, updateFinAccount, deleteFinAccount, createFinAccountTrans, createFinAccountRole, createFinAccountAuth, setFinAccountTransStatus, and depositWithdrawPayments services.
Users are recommended to upgrade to version 24.09.08, which fixes this issue.
apache_ofbiz < 24.09.08Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-85627NoneApache OFBiz: Authenticated Code Execution Vulnerability
CVE-2026-100168NoneApache OFBiz: Missing Authorization vulnerability
CVE-2026-105325NoneApache OFBiz: Missing authorization in payment application services allows view-only users to modify payment allocations
CVE-2026-105461NoneApache OFBiz: Missing authorization in updateOrderItems allows view-only users to modify order prices and quantities
CVE-2026-114235NoneApache OFBiz: Direct Request in Order Manager Enables Unauthorized Tracking Number Modification
CVE-2026-66903Medium· 6.5Apache OFBiz: Authenticated Path Traversal in Catalog Image Management