{"id":"CVE-2026-105461","kind":"vulnerability","aliases":["CVE-2026-105461"],"related":[],"title":"ordermgr: users with view-only permission can update orders","description":"Missing check for  ORDERMGR_UPDATE in ordermgr allows user with only ORDERMGR_VIEW permission to update orders.\n\nAffected versions before : 24.09.08\n\nUsers are recommended to upgrade to version 24.09.08 which fixes this issue.","summary":"The ordermgr component is missing a permission check for ORDERMGR_UPDATE, so a user who only holds ORDERMGR_VIEW can change orders. An attacker with view-only access can modify order records they should only be able to read.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ordermgr","other"],"not_affected_if":["no-view-only-users","version-24.09.08-or-later"],"how_to_check":"- Confirm the installed ordermgr version and compare it with `24.09.08`\n- Review which accounts hold only the ORDERMGR_VIEW permission and whether they can submit order updates","fix":"- Upgrade ordermgr to `24.09.08` or later","status":"open","published_at":"2026-11-05T14:16:59+00:00","first_seen_at":"2026-11-05T14:39:17+00:00","triaged_at":"2026-11-05T14:40:55+00:00","updated_at":"2026-11-05T14:40:55+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-11-05T14:40:55Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade ordermgr to `24.09.08` or later","reach":"network","title":"ordermgr: users with view-only permission can update orders","impact":"medium","summary":"The ordermgr component is missing a permission check for ORDERMGR_UPDATE, so a user who only holds ORDERMGR_VIEW can change orders. An attacker with view-only access can modify order records they should only be able to read.","audience":"businesses","category":"other","nicknames":[],"who_cares":["ordermgr"],"confidence":0.6,"fix_status":"available","needs_auth":"yes","worst_case":"Authenticated view-only user modifies existing orders","analyst_note":"","how_to_check":"- Confirm the installed ordermgr version and compare it with `24.09.08`\n- Review which accounts hold only the ORDERMGR_VIEW permission and whether they can submit order updates","plain_action":"","needs_analyst":false,"not_affected_if":["version-24.09.08-or-later","no-view-only-users"],"who_is_affected":"Any deployment of ordermgr before 24.09.08 where some users are granted ORDERMGR_VIEW without ORDERMGR_UPDATE. Deployments where every user with access holds the update permission, or that are already on 24.09.08 or later, are not exposed by this flaw.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"unknown"},"cost_usd":0.000668,"input_tokens":4219,"output_tokens":492,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-105461':13A,16A '-2026':12A,15A '24.09.08':78C,86C 'abl':55B 'access':46B 'affect':75C 'allow':65C 'attack':41B 'chang':38B 'check':25B,59C 'compon':20B 'cve':11A,14A 'fix':88C 'hold':34B 'issu':90C 'miss':22B,58C 'modifi':48B 'order':10A,39B,49B,74C 'ordermgr':1A,17B,19B,27B,35B,61C,64C,69C 'permiss':7A,24B,71C 'read':57B 'recommend':81C 'record':50B 'updat':9A,28B,62C,73C 'upgrad':83C 'user':2A,31B,66C,79C 'version':76C,85C 'view':5A,36B,44B,70C 'view-on':4A,43B","nicknames":[],"mitigations":[],"who_affected":"Any deployment of ordermgr before 24.09.08 where some users are granted ORDERMGR_VIEW without ORDERMGR_UPDATE. Deployments where every user with access holds the update permission, or that are already on 24.09.08 or later, are not exposed by this flaw.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["ordermgr","other","unknown"],"campaign_type":null,"first_public_at":"2026-11-05T14:16:59+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-105461","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105461","severity":null,"published_at":"2026-11-05T14:16:59+00:00","modified_at":"2026-11-05T14:16:59+00:00","first_seen_at":"2026-11-05T14:39:17+00:00","fetched_at":"2026-11-05T14:39:17+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}