CVE-2026-109129
Awaiting Analysis Awaiting Analysis - Queue

Authorization Bypass in Apache OFBiz Order Manager

Publication date: 2026-11-05

Last updated on: 2026-11-05

Assigner: Apache Software Foundation

Description
Authorization Bypass Through User-Controlled Key in the Order Manager component in Apache OFBiz 24.09.07 on all platforms allows an authenticated user with only view-level order permissions to modify or create OrderPaymentPreference records belonging to orders outside their authorized scope via the updateOrderPaymentPreference service, by supplying an orderPaymentPreferenceId belonging to a different order. Users are recommended to upgrade to version 24.09.08, which fixes this issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-05
Last Modified
2026-11-05
Generated
2026-11-05
AI Q&A
2026-11-05
EPSS Evaluated
N/A
NVD
CVE-2026-109129
EUVD
EUVD-2026-117522

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Apache Software Foundation Apache OFBiz 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an authorization bypass in Apache OFBiz 24.09.07. An authenticated user with only view-level order permissions can modify or create OrderPaymentPreference records for orders outside their authorized scope by using the updateOrderPaymentPreference service and providing an orderPaymentPreferenceId from a different order.

Detection Guidance

This vulnerability involves an authorization bypass in Apache OFBiz's Order Manager component. To detect it, check for unauthorized modifications to OrderPaymentPreference records by users with only view-level permissions. Review logs for the updateOrderPaymentPreference service calls with orderPaymentPreferenceId values outside the user's authorized scope. Ensure your Apache OFBiz version is 24.09.08 or later to mitigate this issue.

Impact Analysis

This vulnerability allows unauthorized users to alter payment preferences for orders they should not have access to. This could lead to financial discrepancies, incorrect billing, or potential fraud if exploited maliciously.

Compliance Impact

This vulnerability allows unauthorized modification of order data by authenticated users with limited permissions. For GDPR, this could lead to unauthorized access or alteration of personal data, violating principles of data integrity and security. For HIPAA, it may compromise protected health information integrity if order data includes such records.

Mitigation Strategies

Upgrade Apache OFBiz to version 24.09.08 or later to fix the authorization bypass issue in the Order Manager component.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-109129. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...