{"id":"CVE-2026-109856","kind":"vulnerability","aliases":["CVE-2026-109856"],"related":[],"title":"Apache OFBiz: low-privilege users can alter financial account balances and transactions","description":"Direct Request ('Forced Browsing') to Financial Account services in Apache OFBiz 24.09 before 24.09.08 on all platforms allows an authenticated user with any valid low-privilege account to create, modify, and cancel financial account transactions and balances without appropriate permission via direct requests to the createFinAccount, updateFinAccount, deleteFinAccount, createFinAccountTrans, createFinAccountRole, createFinAccountAuth, setFinAccountTransStatus, and depositWithdrawPayments services.\n\nUsers are recommended to upgrade to version 24.09.08, which fixes this issue.","summary":"Apache OFBiz 24.09 before 24.09.08 lets any logged-in user with a low-privilege account call financial account services directly, bypassing permission checks. An attacker can create, modify and cancel financial account transactions and balances.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["apache-ofbiz","erp","package","self-hosted"],"not_affected_if":["no-untrusted-accounts","version-not-24.09"],"how_to_check":"- Check the installed OFBiz version in the release files or `VERSION` file and confirm whether it is 24.09 earlier than `24.09.08`\n- Review whether accounts outside finance roles can reach the financial account services listed in the advisory","fix":"- Apache OFBiz: upgrade to `24.09.08`","status":"open","published_at":"2026-11-05T14:17:00+00:00","first_seen_at":"2026-11-05T14:39:17+00:00","triaged_at":"2026-11-05T14:40:52+00:00","updated_at":"2026-11-05T14:40:52+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-05T14:40:52Z","model":"claude-haiku-5-5","output":{"fix":"- Apache OFBiz: upgrade to `24.09.08`","reach":"network","title":"Apache OFBiz: low-privilege users can alter financial account balances and transactions","impact":"medium","summary":"Apache OFBiz 24.09 before 24.09.08 lets any logged-in user with a low-privilege account call financial account services directly, bypassing permission checks. An attacker can create, modify and cancel financial account transactions and balances.","audience":"businesses","category":"package","nicknames":[],"who_cares":["apache-ofbiz","self-hosted","erp"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"Attacker alters financial balances and transactions without permission","analyst_note":"","how_to_check":"- Check the installed OFBiz version in the release files or `VERSION` file and confirm whether it is 24.09 earlier than `24.09.08`\n- Review whether accounts outside finance roles can reach the financial account services listed in the advisory","plain_action":"","needs_analyst":false,"not_affected_if":["version-not-24.09","no-untrusted-accounts"],"who_is_affected":"Teams running Apache OFBiz 24.09 releases before 24.09.08 with user accounts that are not meant to handle finance. Any valid login, even a low-privilege one, can reach the affected services, so exposure depends on who holds accounts. Instances on other OFBiz versions are not covered by this description.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000703,"input_tokens":4334,"output_tokens":539,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-109856':16A,19A '-2026':15A,18A '24.09':30B,76C '24.09.08':32B,78C,128C 'account':10A,44B,47B,61B,71C,92C,99C 'allow':82C 'alter':8A 'apach':1A,21B,28B,74C 'apache-ofbiz':20B 'appropri':104C 'attack':54B 'authent':84C 'balanc':11A,64B,102C 'brows':68C 'bypass':50B 'call':45B 'cancel':59B,97C 'check':52B 'creat':56B,94C 'createfinaccount':111C 'createfinaccountauth':116C 'createfinaccountrol':115C 'createfinaccounttran':114C 'cve':14A,17A 'deletefinaccount':113C 'depositwithdrawpay':119C 'direct':49B,65C,107C 'erp':23B 'financi':9A,46B,60B,70C,98C 'fix':130C 'forc':67C 'host':27B 'issu':132C 'let':33B 'log':36B 'logged-in':35B 'low':4A,42B,90C 'low-privileg':3A,41B,89C 'modifi':57B,95C 'ofbiz':2A,22B,29B,75C 'packag':24B 'permiss':51B,105C 'platform':81C 'privileg':5A,43B,91C 'recommend':123C 'request':66C,108C 'self':26B 'self-host':25B 'servic':48B,72C,120C 'setfinaccounttransstatus':117C 'transact':13A,62B,100C 'updatefinaccount':112C 'upgrad':125C 'user':6A,38B,85C,121C 'valid':88C 'version':127C 'via':106C 'without':103C","nicknames":[],"mitigations":[],"who_affected":"Teams running Apache OFBiz 24.09 releases before 24.09.08 with user accounts that are not meant to handle finance. Any valid login, even a low-privilege one, can reach the affected services, so exposure depends on who holds accounts. Instances on other OFBiz versions are not covered by this description.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["apacheofbiz","erp","high","package","selfhosted"],"campaign_type":null,"first_public_at":"2026-11-05T14:17:00+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-109856","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109856","severity":null,"published_at":"2026-11-05T14:17:00+00:00","modified_at":"2026-11-05T14:17:00+00:00","first_seen_at":"2026-11-05T14:39:17+00:00","fetched_at":"2026-11-05T14:39:17+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}