CVE-2026-100228
Apache OFBiz: Improper Input Validation in Order Returns Enables Unauthorized Refund Price Manipulation
Improper Input Validation in Order Returns in Apache OFBiz 24.09.07 on all platforms allows an authenticated user without the ORDERMGR_CREATE permission to persist an arbitrary price on a return item via the createReturnItem service, bypassing the intended server-computed price ceiling. Users are recommended to upgrade to version 24.09.08, which fixes this issue.
Exploit likelihood
What each source reports
CVE List No score
Apache OFBiz: Improper Input Validation in Order Returns Enables Unauthorized Refund Price Manipulation
Improper Input Validation in Order Returns in Apache OFBiz 24.09.07 on all platforms allows an authenticated user without the ORDERMGR_CREATE permission to persist an arbitrary price on a return item via the createReturnItem service, bypassing the intended server-computed price ceiling. Users are recommended to upgrade to version 24.09.08, which fixes this issue.
- Record
CVE-2026-100228- Weakness
- CWE-20
- Updated
- 2026-11-05
EUVDEUVD-2026-117460 No score
Improper Input Validation in Order Returns in Apache OFBiz 24.09.07 on all platforms allows an authenticated user without the ORDERMGR_CREATE permission to persist an arbitrary price on a return item via the createReturnItem service, bypassing the intended server-computed price ceiling. Users are recommended to upgrade to version 24.09.08, which fixes this issue.
- Record
EUVD-2026-117460- Updated
- 2026-11-05
GitHub AdvisoriesGHSA-29j7-h7qg-q9xv No score
Improper Input Validation in Order Returns in Apache OFBiz 24.09.07 on all platforms allows an...
Improper Input Validation in Order Returns in Apache OFBiz 24.09.07 on all platforms allows an authenticated user without the ORDERMGR_CREATE permission to persist an arbitrary price on a return item via the createReturnItem service, bypassing the intended server-computed price ceiling. Users are recommended to upgrade to version 24.09.08, which fixes this issue.
- Record
GHSA-29j7-h7qg-q9xv- Weakness
- CWE-20
- Updated
- 2026-11-05
NVD No score
Improper Input Validation in Order Returns in Apache OFBiz 24.09.07 on all platforms allows an authenticated user without the ORDERMGR_CREATE permission to persist an arbitrary price on a return item via the createReturnItem service, bypassing the intended server-computed price ceiling. Users are recommended to upgrade to version 24.09.08, which fixes this issue.
- Record
CVE-2026-100228- Weakness
- CWE-20
- Updated
- 2026-11-05
Affected products
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-100228 is a vulnerability with no CVSS score yet in Apache Software Foundation Ofbiz, published November 5, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.20%, the 10th percentile. No source names a fixed version.