This site currently shows sample data for demonstration.
BDVDB
বাংলা

Vulnerabilities

CVE-2026-109129 | BDVDB-2026-400697 Detail

ApacheApache OFBiz

Description#

Authorization Bypass Through User-Controlled Key in the Order Manager component in Apache OFBiz 24.09.07 on all platforms allows an authenticated user with only view-level order permissions to modify or create OrderPaymentPreference records belonging to orders outside their authorized scope via the updateOrderPaymentPreference service, by supplying an orderPaymentPreferenceId belonging to a different order. Users are recommended to upgrade to version 24.09.08, which fixes this issue.

Impact#

No impact statement in the source data.

Weaknesses#

  • CWE-639 Authorization Bypass Through User-Controlled Key

References#

Exploit#

No public exploit known

History#

  1. Version 1Record published in the CVE List.