CVE-2026-114235 · Package
NO FIX YET · SEE WHAT TO DO
In Apache OFBiz 24.09 before 24.09.08, the Order component's updateTrackingNumber endpoint can be called directly, skipping its access check. A user who holds only view access to the Order Manager can change the shipment tracking number on any order.
first public Nov 5, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Any team running Apache OFBiz 24.09 earlier than 24.09.08 where staff have view-only access to the Order Manager. The flaw is a missing permission check on a direct request, so the attacker needs a logged-in account, but not edit rights. Installations on 24.09.08 or later, or with no authenticated staff accounts, are not affected.
Not affected if no-order-manager-view-users, version-24.09.08-or-later
Who cares apache-ofbiz, erp, self-hosted
24.09 before 24.09.08.24.09.08.Direct Request ('Forced Browsing') in the Order component in Apache OFBiz 24.09 before 24.09.08 on all platforms allows an authenticated user with only view access to the Order Manager to modify the shipment tracking number of any order via a direct request to the updateTrackingNumber endpoint. Users are recommended to upgrade to version 24.09.08, which fixes this issue.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.