4 matches found
CVE-2026-109129
Authorization Bypass Through User-Controlled Key in the Order Manager component in Apache OFBiz 24.09.07 on all platforms allows an authenticated user with only view-level order permissions to modify or create OrderPaymentPreference records belonging to orders outside their authorized scope via t...
CVE-2026-109129 Apache OFBiz: Authorization Bypass Through User-Controlled Key in OrderServices Enables Unauthorized Payment Preference Modification
Authorization Bypass Through User-Controlled Key in the Order Manager component in Apache OFBiz 24.09.07 on all platforms allows an authenticated user with only view-level order permissions to modify or create OrderPaymentPreference records belonging to orders outside their authorized scope via t...
CVE-2026-109129
Apache OFBiz version 24.09.07 on all platforms is vulnerable to an authorization bypass via a user-controlled key in the Order Manager component. An authenticated user with only view-level permissions can modify or create OrderPaymentPreference records for orders outside their authorized scope by...
EUVD-2026-117522
Authorization Bypass Through User-Controlled Key in the Order Manager component in Apache OFBiz 24.09.07 on all platforms allows an authenticated user with only view-level order permissions to modify or create OrderPaymentPreference records belonging to orders outside their authorized scope via t...