CVE-2026-114271 · Runtime
NO FIX YET · SEE WHAT TO DO
Apache OFBiz 24.09 before 24.09.08 lets a logged-in low-privileged user, such as a self-registered customer, change another party's shopping list by supplying that list's ID to the update endpoint. The attacker can take ownership of the list and read its contents.
first public Nov 5, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Any OFBiz 24.09 deployment before 24.09.08 that exposes the shopping list services to registered users is affected, on all platforms. Customer self-registration makes the attack easier because any new account can be used. Teams running OFBiz versions outside 24.09, or without the shopping list functionality exposed, can skip it.
Not affected if no-shopping-list-exposed, version-outside-24.09
Who cares apache-ofbiz, ecommerce, java
ofbiz release or build metadata; affected versions are 24.09 releases before 24.09.0824.09.08Authorization Bypass Through User-Controlled Key in the shopping list services in Apache OFBiz 24.09 before 24.09.08 on all platforms allows an authenticated low-privileged user, such as a self-registered ecommerce customer, to modify another party's shopping list or take ownership of it, and thereby read its contents, via a request to the shopping list update endpoint that supplies the other party's shopping list ID.
Users are recommended to upgrade to version 24.09.08, which fixes this issue.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.