CVE-2026-105325 Apache OFBiz: Missing authorization in payment application services allows view-only users to modify payment allocations

Missing check for ACCOUNTINGUPDATE / ACCOUNTINGCREATE in accounting in allows user with only ACCOUNTINGVIEW permission to update/create PaymentApplication. Affected versions before : 24.09.08 Users are recommended to upgrade to version 24.09.08 which fixes this issue...

CVE-2026-105325

Apache OFBiz is vulnerable to a missing authorization check in its accounting services. Specifically, the system fails to verify ACCOUNTING_UPDATE or ACCOUNTING_CREATE permissions, which allows a user with only ACCOUNTING_VIEW permissions to update or create a PaymentApplication . This vulnerabil...