{"cve":"CVE-2026-109837","enrichment":{"created":"2026-11-05T14:30:08.129712+00:00","updated":"2026-11-05T14:30:08.129718+00:00","vendors":[]},"mitre":{"cpes":[],"created":"2026-11-05T13:38:04.465000+00:00","description":"Authorization Bypass Through User-Controlled Key in Order Returns in Apache OFBiz 24.09 before 24.09.08 on all platforms allows an authenticated user with low-privileged Order Manager access to associate another party's OrderItem with a ReturnItem on a ReturnHeader they control, via the createReturnItem service. Users are recommended to upgrade to version 24.09.08, which fixes this issue.","metrics":{"cvssV2_0":{},"cvssV3_0":{},"cvssV3_1":{},"cvssV4_0":{}},"mitre_repo_path":"cves/2026/109xxx/CVE-2026-109837.json","references":["https://lists.apache.org/thread.html/7b2syzksp7klt9fvhdg0olldvs2g83lz"],"title":"Apache OFBiz: Authorization Bypass Through User-Controlled Key in Order Returns Enables Cross-Party OrderItem Association","updated":"2026-11-05T13:38:04.465000+00:00","vendors":[],"weaknesses":["CWE-639"]},"nvd":{"cpes":[],"created":"2026-11-05T14:17:00.073000+00:00","description":"Authorization Bypass Through User-Controlled Key in Order Returns in Apache OFBiz 24.09 before 24.09.08 on all platforms allows an authenticated user with low-privileged Order Manager access to associate another party's OrderItem with a ReturnItem on a ReturnHeader they control, via the createReturnItem service. Users are recommended to upgrade to version 24.09.08, which fixes this issue.","metrics":{"cvssV2_0":{},"cvssV3_0":{},"cvssV3_1":{},"cvssV4_0":{}},"nvd_repo_path":"2026/CVE-2026-109837.json","references":["https://lists.apache.org/thread.html/7b2syzksp7klt9fvhdg0olldvs2g83lz"],"title":null,"updated":"2026-11-05T14:48:26.210000+00:00","vendors":[],"weaknesses":["CWE-639"]},"opencve":{"changes":[{"created":"2026-11-05T13:45:00+00:00","data":[{"details":{"new":"Authorization Bypass Through User-Controlled Key in Order Returns in Apache OFBiz 24.09 before 24.09.08 on all platforms allows an authenticated user with low-privileged Order Manager access to associate another party's OrderItem with a ReturnItem on a ReturnHeader they control, via the createReturnItem service. Users are recommended to upgrade to version 24.09.08, which fixes this issue.","old":null},"type":"description"},{"details":{"new":"Apache OFBiz: Authorization Bypass Through User-Controlled Key in Order Returns Enables Cross-Party OrderItem Association","old":null},"type":"title"},{"details":{"added":["CWE-639"],"removed":[]},"type":"weaknesses"},{"details":{"added":["https://lists.apache.org/thread.html/7b2syzksp7klt9fvhdg0olldvs2g83lz"],"removed":[]},"type":"references"}],"id":"c546b5db-4660-440b-957e-f34c13f1dd80"}],"cpes":{"data":[],"providers":[]},"created":{"data":"2026-11-05T13:38:04.465000+00:00","provider":"mitre"},"description":{"data":"Authorization Bypass Through User-Controlled Key in Order Returns in Apache OFBiz 24.09 before 24.09.08 on all platforms allows an authenticated user with low-privileged Order Manager access to associate another party's OrderItem with a ReturnItem on a ReturnHeader they control, via the createReturnItem service. Users are recommended to upgrade to version 24.09.08, which fixes this issue.","provider":"mitre"},"metrics":{"cvssV2_0":{"data":{},"provider":null},"cvssV3_0":{"data":{},"provider":null},"cvssV3_1":{"data":{},"provider":null},"cvssV4_0":{"data":{},"provider":null},"epss":{"data":{},"provider":null},"kev":{"data":{},"provider":null},"ssvc":{"data":{},"provider":null},"threat_severity":{"data":null,"provider":null}},"references":{"data":["https://lists.apache.org/thread.html/7b2syzksp7klt9fvhdg0olldvs2g83lz"],"providers":["mitre","nvd"]},"title":{"data":"Apache OFBiz: Authorization Bypass Through User-Controlled Key in Order Returns Enables Cross-Party OrderItem Association","provider":"mitre"},"updated":{"data":"2026-11-05T13:38:04.465000+00:00","provider":"mitre"},"vendors":{"data":[],"providers":[]},"weaknesses":{"data":["CWE-639"],"providers":["mitre","nvd"]}}}