CVE-2026-105461 · Other
NO FIX YET · SEE WHAT TO DO
The ordermgr component is missing a permission check for ORDERMGR_UPDATE, so a user who only holds ORDERMGR_VIEW can change orders. An attacker with view-only access can modify order records they should only be able to read.
first public Nov 5, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Any deployment of ordermgr before 24.09.08 where some users are granted ORDERMGR_VIEW without ORDERMGR_UPDATE. Deployments where every user with access holds the update permission, or that are already on 24.09.08 or later, are not exposed by this flaw.
Not affected if no-view-only-users, version-24.09.08-or-later
Who cares ordermgr
24.09.0824.09.08 or laterMissing check for ORDERMGR_UPDATE in ordermgr allows user with only ORDERMGR_VIEW permission to update orders.
Affected versions before : 24.09.08
Users are recommended to upgrade to version 24.09.08 which fixes this issue.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.