CVE-2026-105461Apache OFBiz: Missing authorization in updateOrderItems allows view-only users to modify order prices and quantities

Missing check for ORDERMGR_UPDATE in ordermgr allows user with only ORDERMGR_VIEW permission to update orders. Affected versions before : 24.09.08 Users are recommended to upgrade to version 24.09.08 which fixes this issue.

EPSS 0.15%Not in KEVNVD: Awaiting Analysis

Last updated: 2026-11-05 14:48 UTC

Overview Affected Products References

NVD CVE.org

Overview

Severity

No CVSS score has been published for CVE-2026-105461 yet.

Details

CVE ID: CVE-2026-105461
Status: Awaiting Analysis
Assigner (CNA): apache
Published: Nov 5, 2026
Last modified: 2026-11-05 14:48 UTC
Weaknesses: CWE-425

Sources

NVD
CVE.org
CISA KEV
FIRST EPSS

Refreshed hourly from the sources above. Last fetched 2026-11-08 08:26 UTC.