CVE-2026-114235None▾ SunlitDirect Request ('Forced Browsing') in the Order component in Apache OFBiz 24.09 before 24.09.08 on all platforms allows an authenticated user with only view access to the Order Manager to modify the shipment tracking number of any order …
▾ Sunlit zone — Low / medium · no exploitation signal
impact 2.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Direct Request ('Forced Browsing') in the Order component in Apache OFBiz 24.09 before 24.09.08 on all platforms allows an authenticated user with only view access to the Order Manager to modify the shipment tracking number of any order via a direct request to the updateTrackingNumber endpoint. Users are recommended to upgrade to version 24.09.08, which fixes this issue.
apache_ofbiz < 24.09.08Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-85627NoneApache OFBiz: Authenticated Code Execution Vulnerability
CVE-2026-100168NoneApache OFBiz: Missing Authorization vulnerability
CVE-2026-105325NoneApache OFBiz: Missing authorization in payment application services allows view-only users to modify payment allocations
CVE-2026-105461NoneApache OFBiz: Missing authorization in updateOrderItems allows view-only users to modify order prices and quantities
CVE-2026-109856NoneApache OFBiz: Missing Authorization in Financial Account Services Enables Unauthorized Balance Manipulation
CVE-2026-66903Medium· 6.5Apache OFBiz: Authenticated Path Traversal in Catalog Image Management