CVE-2026-105461

Apache OFBiz versions prior to 24.09.08 are vulnerable to a missing authorization check in the ordermgr component. Specifically, the updateOrderItems function fails to verify the ORDERMGR_UPDATE permission, allowing users with only ORDERMGR_VIEW permissions to modify order prices and quantities. ...