CVE-2026-114235
Awaiting Analysis Awaiting Analysis - Queue

Direct Request Forced Browsing in Apache OFBiz Order Component

Publication date: 2026-11-05

Last updated on: 2026-11-05

Assigner: Apache Software Foundation

Description
Direct Request ('Forced Browsing') in the Order component in Apache OFBiz 24.09 before 24.09.08 on all platforms allows an authenticated user with only view access to the Order Manager to modify the shipment tracking number of any order via a direct request to the updateTrackingNumber endpoint. Users are recommended to upgrade to version 24.09.08, which fixes this issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-05
Last Modified
2026-11-05
Generated
2026-11-05
AI Q&A
2026-11-05
EPSS Evaluated
N/A
NVD
CVE-2026-114235
EUVD
EUVD-2026-117516

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Apache Software Foundation Apache OFBiz 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-425 The web application does not adequately enforce appropriate authorization on all restricted URLs, scripts, or files.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Direct Request vulnerability in Apache OFBiz 24.09 before 24.09.08. An authenticated user with only view access to the Order Manager can modify the shipment tracking number of any order by sending a direct request to the updateTrackingNumber endpoint.

Detection Guidance

This vulnerability involves an authenticated user with view access modifying shipment tracking numbers via a direct request to the updateTrackingNumber endpoint in Apache OFBiz. To detect it, monitor HTTP requests to /order/control/updateTrackingNumber for unauthorized POST requests from users with only view permissions. Check OFBiz logs for suspicious direct requests to this endpoint.

Impact Analysis

An attacker could change shipment tracking numbers, leading to confusion, delivery disruptions, or fraud. This could affect order fulfillment and customer trust.

Compliance Impact

This vulnerability allows an authenticated user with limited access to modify shipment tracking numbers, which could lead to unauthorized changes in order data. This may impact compliance with GDPR by potentially exposing or altering personal data without proper authorization, and with HIPAA if order data includes protected health information.

Mitigation Strategies

Upgrade Apache OFBiz to version 24.09.08 or later to fix the vulnerability in the Order component.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-114235. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...