CVE-2026-114235

Direct Request 'Forced Browsing' in the Order component in Apache OFBiz 24.09 before 24.09.08 on all platforms allows an authenticated user with only view access to the Order Manager to modify the shipment tracking number of any order via a direct request to the updateTrackingNumber endpoint. Use...

CVE-2026-114235

Apache OFBiz versions 24.09 before 24.09.08 on all platforms are vulnerable to a Direct Request (Forced Browsing) vulnerability within the Order component . This flaw allows an authenticated user with only view access to the Order Manager to perform unauthorized modifications to the shipment trac...

EUVD-2026-117516

Direct Request 'Forced Browsing' in the Order component in Apache OFBiz 24.09 before 24.09.08 on all platforms allows an authenticated user with only view access to the Order Manager to modify the shipment tracking number of any order via a direct request to the updateTrackingNumber endpoint. Use...