CVE-2026-105461
Apache OFBiz: Missing authorization in updateOrderItems allows view-only users to modify order prices and quantities
Missing check for ORDERMGR_UPDATE in ordermgr allows user with only ORDERMGR_VIEW permission to update orders.
Affected versions before : 24.09.08
Users are recommended to upgrade to version 24.09.08 which fixes this issue.
Exploit likelihood
What each source reports
CVE List No score
Apache OFBiz: Missing authorization in updateOrderItems allows view-only users to modify order prices and quantities
Missing check for ORDERMGR_UPDATE in ordermgr allows user with only ORDERMGR_VIEW permission to update orders.
Affected versions before : 24.09.08
Users are recommended to upgrade to version 24.09.08 which fixes this issue.
- Record
CVE-2026-105461- Weakness
- CWE-425
- Updated
- 2026-11-05
EUVDEUVD-2026-117523 No score
Missing check for ORDERMGR_UPDATE in ordermgr allows user with only ORDERMGR_VIEW permission to update orders.
Affected versions before : 24.09.08
Users are recommended to upgrade to version 24.09.08 which fixes this issue.
- Record
EUVD-2026-117523- Updated
- 2026-11-05
GitHub AdvisoriesGHSA-vr6p-72w4-fx5w No score
Missing check for ORDERMGR_UPDATE in ordermgr allows user with only ORDERMGR_VIEW permission to...
Missing check for ORDERMGR_UPDATE in ordermgr allows user with only ORDERMGR_VIEW permission to update orders.
Affected versions before : 24.09.08
Users are recommended to upgrade to version 24.09.08 which fixes this issue.
- Record
GHSA-vr6p-72w4-fx5w- Weakness
- CWE-425
- Updated
- 2026-11-05
NVD No score
Missing check for ORDERMGR_UPDATE in ordermgr allows user with only ORDERMGR_VIEW permission to update orders.
Affected versions before : 24.09.08
Users are recommended to upgrade to version 24.09.08 which fixes this issue.
- Record
CVE-2026-105461- Weakness
- CWE-425
- Updated
- 2026-11-05
Affected products
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-105461 is a vulnerability with no CVSS score yet in Apache Software Foundation Ofbiz, published November 5, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.15%, the 4th percentile. No source names a fixed version.