CVE-2026-100228 · Package
NO FIX YET · SEE WHAT TO DO
In Apache OFBiz 24.09.07, an authenticated user without the ORDERMGR_CREATE permission can save an arbitrary price on a return item through the createReturnItem service. This bypasses the server-computed price limit, so a user could record return amounts they should not be able to set.
first public Nov 5, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Teams running Apache OFBiz 24.09.07 on any platform where logged-in users can reach order returns. The flaw needs an account but not the ORDERMGR_CREATE permission. Installations on other OFBiz versions, or where only trusted staff with that permission have accounts, are less exposed.
Not affected if no-authenticated-users, other-versions
Who cares apache-ofbiz, erp, self-hosted
24.09.07.24.09.08Improper Input Validation in Order Returns in Apache OFBiz 24.09.07 on all platforms allows an authenticated user without the ORDERMGR_CREATE permission to persist an arbitrary price on a return item via the createReturnItem service, bypassing the intended server-computed price ceiling. Users are recommended to upgrade to version 24.09.08, which fixes this issue.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.