---
id: "CVE-2026-114233"
kind: "vulnerability"
aliases: ["CVE-2026-114233"]
title: "Apache OFBiz: order view users can change approved orders and prices"
severity: "medium"
cvss: null
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["apache-ofbiz", "erp", "order-management", "runtime"]
not_affected_if: ["no-order-manager-use", "no-view-only-users", "ofbiz-not-24.09"]
published_at: "2026-11-05T14:17:00+00:00"
first_seen_at: "2026-11-05T14:39:17+00:00"
updated_at: "2026-11-05T14:40:51+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-114233", "first_seen_at": "2026-11-05T14:39:17+00:00"}]
exploit_sources: []
---

# Apache OFBiz: order view users can change approved orders and prices

In Apache OFBiz 24.09 before 24.09.08, a user with only the order view permission can modify approved orders, including shipping address, shipment method and item prices via two services. The flaw lets that user alter order data they should only read.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed OFBiz version and confirm whether it is `24.09` earlier than `24.09.08`
- Review which accounts hold the `ORDERMGR_VIEW` permission without `ORDERMGR_UPDATE`

## Fix

- Apache OFBiz: upgrade to `24.09.08`

## Timeline

- 2026-11-05T14:39:17+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-114233

## From the sources

Incorrect Privilege Assignment in the Order Manager in Apache OFBiz 24.09 before 24.09.08 on all platforms allows an authenticated user who holds only order view permissions (ORDERMGR_VIEW), without ORDERMGR_UPDATE or any role on the order, to modify approved orders, changing a ship group's shipping address and shipment method or appending items with an overridden price, via the updateShipGroupShipInfo and appendOrderItem services. Users are recommended to upgrade to version 24.09.08, which fixes this issue.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_