CVE-2026-109856
Awaiting Analysis Awaiting Analysis - Queue

Direct Request Forced Browsing in Apache OFBiz

Publication date: 2026-11-05

Last updated on: 2026-11-05

Assigner: Apache Software Foundation

Description
Direct Request ('Forced Browsing') to Financial Account services in Apache OFBiz 24.09 before 24.09.08 on all platforms allows an authenticated user with any valid low-privilege account to create, modify, and cancel financial account transactions and balances without appropriate permission via direct requests to the createFinAccount, updateFinAccount, deleteFinAccount, createFinAccountTrans, createFinAccountRole, createFinAccountAuth, setFinAccountTransStatus, and depositWithdrawPayments services. Users are recommended to upgrade to version 24.09.08, which fixes this issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-05
Last Modified
2026-11-05
Generated
2026-11-05
AI Q&A
2026-11-05
EPSS Evaluated
N/A
NVD
CVE-2026-109856
EUVD
EUVD-2026-117520

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Apache Software Foundation Apache OFBiz 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-425 The web application does not adequately enforce appropriate authorization on all restricted URLs, scripts, or files.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a Direct Request or Forced Browsing flaw in Apache OFBiz 24.09 before 24.09.08. An authenticated user with low privileges can bypass permission checks to create, modify, or cancel financial account transactions and balances by sending direct requests to specific services like createFinAccount or updateFinAccount.

Detection Guidance

This vulnerability involves unauthorized access to financial account services in Apache OFBiz. To detect it, check Apache OFBiz logs for unusual requests to services like createFinAccount, updateFinAccount, or deleteFinAccount from low-privilege accounts. Monitor for direct HTTP requests to these endpoints without proper authorization.

Impact Analysis

An attacker with a low-privilege account could manipulate financial data, leading to unauthorized transactions, incorrect balances, or financial fraud. This could result in financial losses, data integrity issues, or reputational damage for affected organizations using vulnerable OFBiz versions.

Compliance Impact

This vulnerability could violate compliance requirements by allowing unauthorized access to financial data, which may breach GDPR (data protection) or HIPAA (healthcare data privacy). It undermines integrity controls and could lead to regulatory penalties due to unauthorized data modifications.

Mitigation Strategies

Upgrade Apache OFBiz to version 24.09.08 or later immediately to patch this vulnerability. If upgrading is not possible, restrict access to financial account services by implementing proper permission checks and validating user roles before allowing modifications to financial data.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-109856. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...