CVE-2026-114233 · Runtime
NO FIX YET · SEE WHAT TO DO
In Apache OFBiz 24.09 before 24.09.08, a user with only the order view permission can modify approved orders, including shipping address, shipment method and item prices via two services. The flaw lets that user alter order data they should only read.
first public Nov 5, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Only installations of Apache OFBiz 24.09 before 24.09.08 on any platform are exposed, and only to logged-in users who hold the order view permission. Teams not running OFBiz order management can skip it.
Not affected if no-order-manager-use, no-view-only-users, ofbiz-not-24.09
Who cares apache-ofbiz, erp, order-management
24.09 earlier than 24.09.08ORDERMGR_VIEW permission without ORDERMGR_UPDATE24.09.08Incorrect Privilege Assignment in the Order Manager in Apache OFBiz 24.09 before 24.09.08 on all platforms allows an authenticated user who holds only order view permissions (ORDERMGR_VIEW), without ORDERMGR_UPDATE or any role on the order, to modify approved orders, changing a ship group's shipping address and shipment method or appending items with an overridden price, via the updateShipGroupShipInfo and appendOrderItem services. Users are recommended to upgrade to version 24.09.08, which fixes this issue.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.