CVE-2026-100228Apache OFBiz: Improper Input Validation in Order Returns Enables Unauthorized Refund Price Manipulation

Improper Input Validation in Order Returns in Apache OFBiz 24.09.07 on all platforms allows an authenticated user without the ORDERMGR_CREATE permission to persist an arbitrary price on a return item via the createReturnItem service, bypassing the intended server-computed price ceiling. Users are recommended to upgrade to version 24.09.08, which fixes this issue.

EPSS 0.20%Not in KEVNVD: Awaiting Analysis

Last updated: 2026-11-05 14:48 UTC

Overview Affected Products References

NVD CVE.org

Overview

Severity

No CVSS score has been published for CVE-2026-100228 yet.

Details

CVE ID: CVE-2026-100228
Status: Awaiting Analysis
Assigner (CNA): apache
Published: Nov 5, 2026
Last modified: 2026-11-05 14:48 UTC
Weaknesses: CWE-20 · Improper input validation

Sources

NVD
CVE.org
CISA KEV
FIRST EPSS

Refreshed hourly from the sources above. Last fetched 2026-11-08 08:26 UTC.