CVE-2026-100228
Awaiting Analysis Awaiting Analysis - Queue

Improper Input Validation in Apache OFBiz Order Returns

Publication date: 2026-11-05

Last updated on: 2026-11-05

Assigner: Apache Software Foundation

Description
Improper Input Validation in Order Returns in Apache OFBiz 24.09.07 on all platforms allows an authenticated user without the ORDERMGR_CREATE permission to persist an arbitrary price on a return item via the createReturnItem service, bypassing the intended server-computed price ceiling. Users are recommended to upgrade to version 24.09.08, which fixes this issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-05
Last Modified
2026-11-05
Generated
2026-11-05
AI Q&A
2026-11-05
EPSS Evaluated
N/A
NVD
CVE-2026-100228
EUVD
EUVD-2026-117460

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Apache Software Foundation Apache OFBiz 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-20 The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an Improper Input Validation flaw in Apache OFBiz 24.09.07. An authenticated user without ORDERMGR_CREATE permission can exploit the createReturnItem service to set an arbitrary price on a return item, bypassing the server's price ceiling.

Impact Analysis

An attacker could manipulate return item prices to financial gain, causing revenue loss or fraud. Systems relying on price ceilings for returns may be compromised, leading to incorrect financial records.

Compliance Impact

This vulnerability could lead to financial misreporting, violating financial compliance requirements. GDPR or HIPAA violations may occur if manipulated data affects personal or health-related transactions, though direct impact depends on system use.

Mitigation Strategies

Upgrade Apache OFBiz to version 24.09.08 or later to fix the improper input validation issue in the Order Returns functionality.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-100228. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...