CVE-2026-109856

Direct Request 'Forced Browsing' to Financial Account services in Apache OFBiz 24.09 before 24.09.08 on all platforms allows an authenticated user with any valid low-privilege account to create, modify, and cancel financial account transactions and balances without appropriate permission via dire...

CVE-2026-109856

Apache OFBiz versions 24.09 before 24.09.08 are vulnerable to a missing authorization flaw in Financial Account services . An authenticated user with a low-privilege account can perform Forced Browsing to access several services, including createFinAccount, updateFinAccount, deleteFinAccount, cre...