{"id":"CVE-2026-114235","kind":"vulnerability","aliases":["CVE-2026-114235"],"related":[],"title":"Apache OFBiz: view-only users can change order shipment tracking numbers","description":"Direct Request ('Forced Browsing') in the Order component in Apache OFBiz 24.09 before 24.09.08 on all platforms allows an authenticated user with only view access to the Order Manager to modify the shipment tracking number of any order via a direct request to the updateTrackingNumber endpoint. Users are recommended to upgrade to version 24.09.08, which fixes this issue.","summary":"In Apache OFBiz 24.09 before 24.09.08, the Order component's updateTrackingNumber endpoint can be called directly, skipping its access check. A user who holds only view access to the Order Manager can change the shipment tracking number on any order.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["apache-ofbiz","erp","package","self-hosted"],"not_affected_if":["no-order-manager-view-users","version-24.09.08-or-later"],"how_to_check":"- Check the installed OFBiz version; affected releases are `24.09` before `24.09.08`.\n- Look for user accounts that have only view rights to the Order Manager.","fix":"- Apache OFBiz: upgrade to `24.09.08`.","status":"open","published_at":"2026-11-05T14:17:00+00:00","first_seen_at":"2026-11-05T14:39:17+00:00","triaged_at":"2026-11-05T14:40:48+00:00","updated_at":"2026-11-05T14:40:48+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-05T14:40:48Z","model":"claude-haiku-5-5","output":{"fix":"- Apache OFBiz: upgrade to `24.09.08`.","reach":"network","title":"Apache OFBiz: view-only users can change order shipment tracking numbers","impact":"medium","summary":"In Apache OFBiz 24.09 before 24.09.08, the Order component's updateTrackingNumber endpoint can be called directly, skipping its access check. A user who holds only view access to the Order Manager can change the shipment tracking number on any order.","audience":"businesses","category":"package","nicknames":[],"who_cares":["apache-ofbiz","self-hosted","erp"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"Shipment tracking numbers on any order are altered by a view-only user","analyst_note":"","how_to_check":"- Check the installed OFBiz version; affected releases are `24.09` before `24.09.08`.\n- Look for user accounts that have only view rights to the Order Manager.","plain_action":"","needs_analyst":false,"not_affected_if":["version-24.09.08-or-later","no-order-manager-view-users"],"who_is_affected":"Any team running Apache OFBiz 24.09 earlier than 24.09.08 where staff have view-only access to the Order Manager. The flaw is a missing permission check on a direct request, so the attacker needs a logged-in account, but not edit rights. Installations on 24.09.08 or later, or with no authenticated staff accounts, are not affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000698,"input_tokens":4257,"output_tokens":544,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-114235':15A,18A '-2026':14A,17A '24.09':30B,78C '24.09.08':32B,80C,120C 'access':45B,53B,91C 'allow':84C 'apach':1A,20B,28B,76C 'apache-ofbiz':19B 'authent':86C 'brows':70C 'call':41B 'chang':8A,59B 'check':46B 'compon':35B,74C 'cve':13A,16A 'direct':42B,67C,107C 'endpoint':38B,112C 'erp':22B 'fix':122C 'forc':69C 'hold':50B 'host':26B 'issu':124C 'manag':57B,95C 'modifi':97C 'number':12A,63B,101C 'ofbiz':2A,21B,29B,77C 'order':9A,34B,56B,66B,73C,94C,104C 'packag':23B 'platform':83C 'recommend':115C 'request':68C,108C 'self':25B 'self-host':24B 'shipment':10A,61B,99C 'skip':43B 'track':11A,62B,100C 'updatetrackingnumb':37B,111C 'upgrad':117C 'user':6A,48B,87C,113C 'version':119C 'via':105C 'view':4A,52B,90C 'view-on':3A","nicknames":[],"mitigations":[],"who_affected":"Any team running Apache OFBiz 24.09 earlier than 24.09.08 where staff have view-only access to the Order Manager. The flaw is a missing permission check on a direct request, so the attacker needs a logged-in account, but not edit rights. Installations on 24.09.08 or later, or with no authenticated staff accounts, are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["apacheofbiz","erp","medium","package","selfhosted"],"campaign_type":null,"first_public_at":"2026-11-05T14:17:00+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-114235","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114235","severity":null,"published_at":"2026-11-05T14:17:00+00:00","modified_at":"2026-11-05T14:17:00+00:00","first_seen_at":"2026-11-05T14:39:17+00:00","fetched_at":"2026-11-05T14:39:17+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}