{"id":"CVE-2026-114233","kind":"vulnerability","aliases":["CVE-2026-114233"],"related":[],"title":"Apache OFBiz: order view users can change approved orders and prices","description":"Incorrect Privilege Assignment in the Order Manager in Apache OFBiz 24.09 before 24.09.08 on all platforms allows an authenticated user who holds only order view permissions (ORDERMGR_VIEW), without ORDERMGR_UPDATE or any role on the order, to modify approved orders, changing a ship group's shipping address and shipment method or appending items with an overridden price, via the updateShipGroupShipInfo and appendOrderItem services. Users are recommended to upgrade to version 24.09.08, which fixes this issue.","summary":"In Apache OFBiz 24.09 before 24.09.08, a user with only the order view permission can modify approved orders, including shipping address, shipment method and item prices via two services. The flaw lets that user alter order data they should only read.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["apache-ofbiz","erp","order-management","runtime"],"not_affected_if":["no-order-manager-use","no-view-only-users","ofbiz-not-24.09"],"how_to_check":"- Check the installed OFBiz version and confirm whether it is `24.09` earlier than `24.09.08`\n- Review which accounts hold the `ORDERMGR_VIEW` permission without `ORDERMGR_UPDATE`","fix":"- Apache OFBiz: upgrade to `24.09.08`","status":"open","published_at":"2026-11-05T14:17:00+00:00","first_seen_at":"2026-11-05T14:39:17+00:00","triaged_at":"2026-11-05T14:40:51+00:00","updated_at":"2026-11-05T14:40:51+00:00","category":"runtime","confidence":0.7,"triage":{"at":"2026-11-05T14:40:51Z","model":"claude-haiku-5-5","output":{"fix":"- Apache OFBiz: upgrade to `24.09.08`","reach":"network","title":"Apache OFBiz: order view users can change approved orders and prices","impact":"medium","summary":"In Apache OFBiz 24.09 before 24.09.08, a user with only the order view permission can modify approved orders, including shipping address, shipment method and item prices via two services. The flaw lets that user alter order data they should only read.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["apache-ofbiz","erp","order-management"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"Authenticated view-only user alters approved order shipping and prices","analyst_note":"","how_to_check":"- Check the installed OFBiz version and confirm whether it is `24.09` earlier than `24.09.08`\n- Review which accounts hold the `ORDERMGR_VIEW` permission without `ORDERMGR_UPDATE`","plain_action":"","needs_analyst":false,"not_affected_if":["ofbiz-not-24.09","no-order-manager-use","no-view-only-users"],"who_is_affected":"Only installations of Apache OFBiz 24.09 before 24.09.08 on any platform are exposed, and only to logged-in users who hold the order view permission. Teams not running OFBiz order management can skip it.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000688,"input_tokens":4317,"output_tokens":512,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-114233':14A,17A '-2026':13A,16A '24.09':29B,77C '24.09.08':31B,79C,138C 'address':46B,114C 'allow':83C 'alter':60B 'apach':1A,19B,27B,75C 'apache-ofbiz':18B 'append':119C 'appendorderitem':129C 'approv':8A,42B,106C 'assign':69C 'authent':85C 'chang':7A,108C 'cve':12A,15A 'data':62B 'erp':21B 'fix':140C 'flaw':56B 'group':111C 'hold':88C 'includ':44B 'incorrect':67C 'issu':142C 'item':50B,120C 'let':57B 'manag':24B,73C 'method':48B,117C 'modifi':41B,105C 'ofbiz':2A,20B,28B,76C 'order':3A,9A,23B,37B,43B,61B,72C,90C,103C,107C 'order-manag':22B 'ordermgr':93C,96C 'overridden':123C 'permiss':39B,92C 'platform':82C 'price':11A,51B,124C 'privileg':68C 'read':66B 'recommend':133C 'role':100C 'runtim':25B 'servic':54B,130C 'ship':45B,110C,113C 'shipment':47B,116C 'two':53B 'updat':97C 'updateshipgroupshipinfo':127C 'upgrad':135C 'user':5A,33B,59B,86C,131C 'version':137C 'via':52B,125C 'view':4A,38B,91C,94C 'without':95C","nicknames":[],"mitigations":[],"who_affected":"Only installations of Apache OFBiz 24.09 before 24.09.08 on any platform are exposed, and only to logged-in users who hold the order view permission. Teams not running OFBiz order management can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["apacheofbiz","erp","medium","ordermanagement","runtime"],"campaign_type":null,"first_public_at":"2026-11-05T14:17:00+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-114233","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114233","severity":null,"published_at":"2026-11-05T14:17:00+00:00","modified_at":"2026-11-05T14:17:00+00:00","first_seen_at":"2026-11-05T14:39:17+00:00","fetched_at":"2026-11-05T14:39:17+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}