---
id: "CVE-2026-114235"
kind: "vulnerability"
aliases: ["CVE-2026-114235"]
title: "Apache OFBiz: view-only users can change order shipment tracking numbers"
severity: "medium"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["apache-ofbiz", "erp", "package", "self-hosted"]
not_affected_if: ["no-order-manager-view-users", "version-24.09.08-or-later"]
published_at: "2026-11-05T14:17:00+00:00"
first_seen_at: "2026-11-05T14:39:17+00:00"
updated_at: "2026-11-05T14:40:48+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-114235", "first_seen_at": "2026-11-05T14:39:17+00:00"}]
exploit_sources: []
---

# Apache OFBiz: view-only users can change order shipment tracking numbers

In Apache OFBiz 24.09 before 24.09.08, the Order component's updateTrackingNumber endpoint can be called directly, skipping its access check. A user who holds only view access to the Order Manager can change the shipment tracking number on any order.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed OFBiz version; affected releases are `24.09` before `24.09.08`.
- Look for user accounts that have only view rights to the Order Manager.

## Fix

- Apache OFBiz: upgrade to `24.09.08`.

## Timeline

- 2026-11-05T14:39:17+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-114235

## From the sources

Direct Request ('Forced Browsing') in the Order component in Apache OFBiz 24.09 before 24.09.08 on all platforms allows an authenticated user with only view access to the Order Manager to modify the shipment tracking number of any order via a direct request to the updateTrackingNumber endpoint. Users are recommended to upgrade to version 24.09.08, which fixes this issue.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_