cve-2026-105461

fkie_nvd
Description

Missing check for  ORDERMGR_UPDATE in ordermgr allows user with only ORDERMGR_VIEW permission to update orders. Affected versions before : 24.09.08 Users are recommended to upgrade to version 24.09.08 which fixes this issue.

Timeline
Published
unknown
Last Modified
unknown
CVSS Details

CVSS details not available.

Affected Products

No product information available.

Weaknesses (CWE)
CWE-425
NVD metadata
NVD status
Awaiting Analysis
Source identifier
security@apache.org
References
Linked Vulnerabilities

No linked vulnerabilities found.

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "Apache OFBiz",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "lessThan": "24.09.08",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "source": "security@apache.org"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Missing check for  ORDERMGR_UPDATE in ordermgr allows user with only ORDERMGR_VIEW permission to update orders.\n\nAffected versions before : 24.09.08\n\nUsers are recommended to upgrade to version 24.09.08 which fixes this issue."
    }
  ],
  "id": "CVE-2026-105461",
  "lastModified": "2026-11-05T14:48:26.210",
  "metrics": {},
  "published": "2026-11-05T14:16:59.570",
  "references": [
    {
      "source": "security@apache.org",
      "url": "https://lists.apache.org/thread.html/7b2syzksp7klt9fvhdg0olldvs2g83lz"
    }
  ],
  "sourceIdentifier": "security@apache.org",
  "vulnStatus": "Awaiting Analysis",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-425"
        }
      ],
      "source": "security@apache.org",
      "type": "Primary"
    }
  ]
}
View JSON API Download JSON