{"id":"CVE-2026-114271","kind":"vulnerability","aliases":["CVE-2026-114271"],"related":[],"title":"Apache OFBiz: authenticated users can modify other customers' shopping lists","description":"Authorization Bypass Through User-Controlled Key in the shopping list services in Apache OFBiz 24.09 before 24.09.08 on all platforms allows an authenticated low-privileged user, such as a self-registered ecommerce customer, to modify another party's shopping list or take ownership of it, and thereby read its contents, via a request to the shopping list update endpoint that supplies the other party's shopping list ID.\n\nUsers are recommended to upgrade to version 24.09.08, which fixes this issue.","summary":"Apache OFBiz 24.09 before 24.09.08 lets a logged-in low-privileged user, such as a self-registered customer, change another party's shopping list by supplying that list's ID to the update endpoint. The attacker can take ownership of the list and read its contents.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["apache-ofbiz","ecommerce","java","runtime"],"not_affected_if":["no-shopping-list-exposed","version-outside-24.09"],"how_to_check":"- Check the installed OFBiz version in the `ofbiz` release or build metadata; affected versions are `24.09` releases before `24.09.08`\n- Confirm whether the ecommerce shopping list services are in use on the deployment","fix":"- Apache OFBiz: upgrade to `24.09.08`","status":"open","published_at":"2026-11-05T14:17:00+00:00","first_seen_at":"2026-11-05T14:39:17+00:00","triaged_at":"2026-11-05T14:40:47+00:00","updated_at":"2026-11-05T14:40:47+00:00","category":"runtime","confidence":0.7,"triage":{"at":"2026-11-05T14:40:47Z","model":"claude-haiku-5-5","output":{"fix":"- Apache OFBiz: upgrade to `24.09.08`","reach":"internet","title":"Apache OFBiz: authenticated users can modify other customers' shopping lists","impact":"medium","summary":"Apache OFBiz 24.09 before 24.09.08 lets a logged-in low-privileged user, such as a self-registered customer, change another party's shopping list by supplying that list's ID to the update endpoint. The attacker can take ownership of the list and read its contents.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["apache-ofbiz","ecommerce","java"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"Attacker reads and takes over other customers' shopping lists","analyst_note":"","how_to_check":"- Check the installed OFBiz version in the `ofbiz` release or build metadata; affected versions are `24.09` releases before `24.09.08`\n- Confirm whether the ecommerce shopping list services are in use on the deployment","plain_action":"","needs_analyst":false,"not_affected_if":["version-outside-24.09","no-shopping-list-exposed"],"who_is_affected":"Any OFBiz 24.09 deployment before 24.09.08 that exposes the shopping list services to registered users is affected, on all platforms. Customer self-registration makes the attack easier because any new account can be used. Teams running OFBiz versions outside 24.09, or without the shopping list functionality exposed, can skip it.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000708,"input_tokens":4293,"output_tokens":557,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-114271':13A,16A '-2026':12A,15A '24.09':25B,87C '24.09.08':27B,89C,150C 'allow':93C 'anoth':45B,110C 'apach':1A,18B,23B,85C 'apache-ofbiz':17B 'attack':61B 'authent':3A,95C 'author':72C 'bypass':73C 'chang':44B 'content':71B,124C 'control':77C 'custom':8A,43B,107C 'cve':11A,14A 'ecommerc':20B,106C 'endpoint':59B,133C 'fix':152C 'id':55B,142C 'issu':154C 'java':21B 'key':78C 'let':28B 'list':10A,49B,53B,67B,82C,114C,131C,141C 'log':31B 'logged-in':30B 'low':34B,97C 'low-privileg':33B,96C 'modifi':6A,109C 'ofbiz':2A,19B,24B,86C 'ownership':64B,117C 'parti':46B,111C,138C 'platform':92C 'privileg':35B,98C 'read':69B,122C 'recommend':145C 'regist':42B,105C 'request':127C 'runtim':22B 'self':41B,104C 'self-regist':40B,103C 'servic':83C 'shop':9A,48B,81C,113C,130C,140C 'suppli':51B,135C 'take':63B,116C 'therebi':121C 'updat':58B,132C 'upgrad':147C 'user':4A,36B,76C,99C,143C 'user-control':75C 'version':149C 'via':125C","nicknames":[],"mitigations":[],"who_affected":"Any OFBiz 24.09 deployment before 24.09.08 that exposes the shopping list services to registered users is affected, on all platforms. Customer self-registration makes the attack easier because any new account can be used. Teams running OFBiz versions outside 24.09, or without the shopping list functionality exposed, can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["apacheofbiz","ecommerce","java","medium","runtime"],"campaign_type":null,"first_public_at":"2026-11-05T14:17:00+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-114271","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114271","severity":null,"published_at":"2026-11-05T14:17:00+00:00","modified_at":"2026-11-05T14:17:00+00:00","first_seen_at":"2026-11-05T14:39:17+00:00","fetched_at":"2026-11-05T14:39:17+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}