CVE-2026-114233
Awaiting Analysis Awaiting Analysis - Queue

Incorrect Privilege Assignment in Apache OFBiz Order Manager

Publication date: 2026-11-05

Last updated on: 2026-11-05

Assigner: Apache Software Foundation

Description
Incorrect Privilege Assignment in the Order Manager in Apache OFBiz 24.09 before 24.09.08 on all platforms allows an authenticated user who holds only order view permissions (ORDERMGR_VIEW), without ORDERMGR_UPDATE or any role on the order, to modify approved orders, changing a ship group's shipping address and shipment method or appending items with an overridden price, via the updateShipGroupShipInfo and appendOrderItem services. Users are recommended to upgrade to version 24.09.08, which fixes this issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-05
Last Modified
2026-11-05
Generated
2026-11-05
AI Q&A
2026-11-05
EPSS Evaluated
N/A
NVD
CVE-2026-114233
EUVD
EUVD-2026-117517

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Apache Software Foundation Apache OFBiz 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-266 A product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in Apache OFBiz 24.09 before 24.09.08 allows an authenticated user with only order view permissions to modify approved orders. They can change shipping addresses, shipment methods, or add items with overridden prices without needing update permissions or any role on the order.

Detection Guidance

Detecting this vulnerability requires checking the Apache OFBiz version and verifying if the Order Manager component is affected. Check the OFBiz version in use and compare it to 24.09.08. If the version is below 24.09.08, the system is vulnerable. Review logs for unauthorized order modifications or changes to shipping addresses and shipment methods.

Impact Analysis

An attacker could alter orders to redirect shipments, change delivery methods, or add unauthorized items at incorrect prices. This could lead to financial loss, delivery disruptions, or fraud if exploited.

Compliance Impact

This vulnerability could violate compliance requirements for data integrity and access controls. It may lead to unauthorized modifications of sensitive order data, potentially breaching GDPR (data protection) or HIPAA (healthcare privacy) if order details include protected information.

Mitigation Strategies

Immediately upgrade Apache OFBiz to version 24.09.08 or later to fix the incorrect privilege assignment issue. Ensure no users have excessive permissions beyond their required roles. Monitor order activities for suspicious modifications and restrict access to order management services.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-114233. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...