---
id: "CVE-2026-109856"
kind: "vulnerability"
aliases: ["CVE-2026-109856"]
title: "Apache OFBiz: low-privilege users can alter financial account balances and transactions"
severity: "high"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["apache-ofbiz", "erp", "package", "self-hosted"]
not_affected_if: ["no-untrusted-accounts", "version-not-24.09"]
published_at: "2026-11-05T14:17:00+00:00"
first_seen_at: "2026-11-05T14:39:17+00:00"
updated_at: "2026-11-05T14:40:52+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-109856", "first_seen_at": "2026-11-05T14:39:17+00:00"}]
exploit_sources: []
---

# Apache OFBiz: low-privilege users can alter financial account balances and transactions

Apache OFBiz 24.09 before 24.09.08 lets any logged-in user with a low-privilege account call financial account services directly, bypassing permission checks. An attacker can create, modify and cancel financial account transactions and balances.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed OFBiz version in the release files or `VERSION` file and confirm whether it is 24.09 earlier than `24.09.08`
- Review whether accounts outside finance roles can reach the financial account services listed in the advisory

## Fix

- Apache OFBiz: upgrade to `24.09.08`

## Timeline

- 2026-11-05T14:39:17+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-109856

## From the sources

Direct Request ('Forced Browsing') to Financial Account services in Apache OFBiz 24.09 before 24.09.08 on all platforms allows an authenticated user with any valid low-privilege account to create, modify, and cancel financial account transactions and balances without appropriate permission via direct requests to the createFinAccount, updateFinAccount, deleteFinAccount, createFinAccountTrans, createFinAccountRole, createFinAccountAuth, setFinAccountTransStatus, and depositWithdrawPayments services.

Users are recommended to upgrade to version 24.09.08, which fixes this issue.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_