CVE-2026-109856

Apache OFBiz versions 24.09 before 24.09.08 are vulnerable to a missing authorization flaw in Financial Account services . An authenticated user with a low-privilege account can perform Forced Browsing to access several services, including createFinAccount, updateFinAccount, deleteFinAccount, cre...