CVE-2026-100228 Apache OFBiz: Improper Input Validation in Order Returns Enables Unauthorized Refund Price Manipulation

Improper Input Validation in Order Returns in Apache OFBiz 24.09.07 on all platforms allows an authenticated user without the ORDERMGRCREATE permission to persist an arbitrary price on a return item via the createReturnItem service, bypassing the intended server-computed price ceiling. Users are...