CVE-2026-109837— Apache OFBiz: Authorization Bypass Through User-Controlled Key in Order Returns Enables Cross-Party OrderItem Association
Quick assessment
Affected
Apache Software Foundation Apache OFBiz
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 Apache OFBiz 24.09（24.09.08 之前版本）中，所有平台上的“订单退货”功能存在通过用户可控键实现的授权绕过漏洞。该漏洞允许拥有低权限“订单管理员”角色的已认证用户，利用 服务，将其他用户的订单行项目（OrderItem）关联到由该用户自己控制的退货头（ReturnHeader）中的退货项（ReturnItem）。建议用户升级至 24.09.08 版本，以修复此问题。
Possible ATT&CK Techniques 1 AI
T1548 · Abuse Elevation Control Mechanism
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-109837
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Apache OFBiz: Authorization Bypass Through User-Controlled Key in Order Returns Enables Cross-Party OrderItem Association
Source: CVE Program / CVE List V5
Vulnerability Description
Authorization Bypass Through User-Controlled Key in Order Returns in Apache OFBiz 24.09 before 24.09.08 on all platforms allows an authenticated user with low-privileged Order Manager access to associate another party's OrderItem with a ReturnItem on a ReturnHeader they control, via the createReturnItem service. Users are recommended to upgrade to version 24.09.08, which fixes this issue.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
通过用户控制密钥绕过授权机制
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Apache Software Foundation | Apache OFBiz | 0 ~ 24.09.08 | - |
|
II. Public POCs for CVE-2026-109837
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-109837
请登录查看更多情报信息。
Other References for CVE-2026-109837 (1)
Same Patch Batch · Apache Software Foundation · 2026-11-05 · 58 CVEs total
| CVE-2026-73098 | 10.0 CRITICAL | Apache Juneau: Unsafe reflection allows attacker-controlled class initialization during pa |
| CVE-2026-73099 | 10.0 CRITICAL | Apache Juneau: Cross-site request forgery via default-enabled content query-parameter body |
| CVE-2026-73100 | 10.0 CRITICAL | Apache Juneau: Sensitive request headers logged in cleartext by the default request logger |
| CVE-2026-73101 | 10.0 CRITICAL | Apache Juneau: Internal exception class and message disclosed via error response header an |
| CVE-2026-73116 | 10.0 CRITICAL | Apache Juneau: REST client forwards credentials to a different origin when following HTTP |
| CVE-2026-73117 | 10.0 CRITICAL | Apache Juneau: Response header CRLF injection and open redirect when applications set head |
| CVE-2026-96677 | 10.0 CRITICAL | Apache Juneau: Cross-site scripting via unescaped request variables in HTML-doc chrome |
| CVE-2026-121489 | 10.0 CRITICAL | Apache Juneau: Path traversal in DirectoryResource allows reading files outside the config |
| CVE-2026-73095 | 8.7 HIGH | Apache Juneau: Denial of service via unbounded memory allocation in parsers and REST reque |
| CVE-2026-103864 | Apache Sling Engine: Request-derived values reach log sinks without CR/LF neutralization | |
| CVE-2026-97355 | Apache OFBiz: Hard-coded Credentials in AdminServer Enable Unauthenticated Denial of Servi | |
| CVE-2026-109856 | Apache OFBiz: Missing Authorization in Financial Account Services Enables Unauthorized Bal | |
| CVE-2026-109129 | Apache OFBiz: Authorization Bypass Through User-Controlled Key in OrderServices Enables Un | |
| CVE-2026-105461 | Apache OFBiz: Missing authorization in updateOrderItems allows view-only users to modify o | |
| CVE-2026-105330 | Apache OFBiz: Use of Hard-coded Cryptographic Key in JWT Token Authentication Enables Unau | |
| CVE-2026-105325 | Apache OFBiz: Missing authorization in payment application services allows view-only users | |
| CVE-2026-100228 | Apache OFBiz: Improper Input Validation in Order Returns Enables Unauthorized Refund Price | |
| CVE-2026-100168 | Apache OFBiz: Missing Authorization vulnerability | |
| CVE-2026-97356 | Apache OFBiz: Insufficiently Protected Credentials in ViewFile Enable Authentication Bypas | |
| CVE-2026-92887 | Apache OFBiz: REST API authentication bypassed by default when the auth attribute is omitt |
Showing top 20 of 58 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: Apache OFBiz
-
CVE-2026-66903
Apache OFBiz: Authenticated Path Traversal in Catalog Image -
CVE-2026-71901
Apache OFBiz: Dispatch arbitrary internal services on SFA co -
CVE-2026-68524
Apache OFBiz: Pre-Authentication Remote Code Execution via A -
CVE-2026-73577
Apache OFBiz: Unauthenticated path-suffix view authorization -
CVE-2026-73578
Apache OFBiz: Unauthenticated saved-view authorization bypas
Same vendor: Apache Software Foundation
-
CVE-2026-66903
Apache OFBiz: Authenticated Path Traversal in Catalog Image -
CVE-2026-71901
Apache OFBiz: Dispatch arbitrary internal services on SFA co -
CVE-2026-68524
Apache OFBiz: Pre-Authentication Remote Code Execution via A -
CVE-2026-73577
Apache OFBiz: Unauthenticated path-suffix view authorization -
CVE-2026-73578
Apache OFBiz: Unauthenticated saved-view authorization bypas
Same weakness: CWE-639
-
CVE-2026-122326
Chevereto before 4.5.8 Private Album Image Disclosure via ge -
CVE-2026-122324
SplitPro through 2.1.6 Authorization Bypass via expense.getE -
CVE-2026-122325
eventyay-exhibition through commit f68888e Cross-Event Atten -
CVE-2026-122317
SplitPro through 2.1.6 Authorization Bypass via user.getUser -
CVE-2026-109129
Apache OFBiz: Authorization Bypass Through User-Controlled K