CVE-2026-105461

Missing check for ORDERMGRUPDATE in ordermgr allows user with only ORDERMGRVIEW permission to update orders. Affected versions before : 24.09.08 Users are recommended to upgrade to version 24.09.08 which fixes this issue...

CVE-2026-105461

Apache OFBiz versions prior to 24.09.08 are vulnerable to a missing authorization check in the ordermgr component. Specifically, the updateOrderItems function fails to verify the ORDERMGR_UPDATE permission, allowing users with only ORDERMGR_VIEW permissions to modify order prices and quantities. ...