CVE-2026-109856 · Package
NO FIX YET · SEE WHAT TO DO
Apache OFBiz 24.09 before 24.09.08 lets any logged-in user with a low-privilege account call financial account services directly, bypassing permission checks. An attacker can create, modify and cancel financial account transactions and balances.
first public Nov 5, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Teams running Apache OFBiz 24.09 releases before 24.09.08 with user accounts that are not meant to handle finance. Any valid login, even a low-privilege one, can reach the affected services, so exposure depends on who holds accounts. Instances on other OFBiz versions are not covered by this description.
Not affected if no-untrusted-accounts, version-not-24.09
Who cares apache-ofbiz, erp, self-hosted
VERSION file and confirm whether it is 24.09 earlier than 24.09.0824.09.08Direct Request ('Forced Browsing') to Financial Account services in Apache OFBiz 24.09 before 24.09.08 on all platforms allows an authenticated user with any valid low-privilege account to create, modify, and cancel financial account transactions and balances without appropriate permission via direct requests to the createFinAccount, updateFinAccount, deleteFinAccount, createFinAccountTrans, createFinAccountRole, createFinAccountAuth, setFinAccountTransStatus, and depositWithdrawPayments services.
Users are recommended to upgrade to version 24.09.08, which fixes this issue.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.