CVE-2026-114235— Apache OFBiz: Direct Request in Order Manager Enables Unauthorized Tracking Number Modification
Quick assessment
Affected
Apache Software Foundation Apache OFBiz
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 Apache OFBiz 24.09（24.09.08 之前版本）的 Order（订单）组件中，存在直接请求（即“强制浏览”）漏洞，该漏洞影响所有平台。该漏洞允许仅拥有订单管理器查看权限的已认证用户，通过直接向 updateTrackingNumber 端点发起请求，修改任意订单的物流追踪号。建议用户升级至 24.09.08 版本，该版本已修复此问题。
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-114235
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Apache OFBiz: Direct Request in Order Manager Enables Unauthorized Tracking Number Modification
Source: CVE Program / CVE List V5
Vulnerability Description
Direct Request ('Forced Browsing') in the Order component in Apache OFBiz 24.09 before 24.09.08 on all platforms allows an authenticated user with only view access to the Order Manager to modify the shipment tracking number of any order via a direct request to the updateTrackingNumber endpoint. Users are recommended to upgrade to version 24.09.08, which fixes this issue.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
直接请求(强制性浏览)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Apache Software Foundation | Apache OFBiz | 0 ~ 24.09.08 | - |
|
II. Public POCs for CVE-2026-114235
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-114235
请登录查看更多情报信息。
Other References for CVE-2026-114235 (1)
Same Patch Batch · Apache Software Foundation · 2026-11-05 · 58 CVEs total
| CVE-2026-73098 | 10.0 CRITICAL | Apache Juneau: Unsafe reflection allows attacker-controlled class initialization during pa |
| CVE-2026-73099 | 10.0 CRITICAL | Apache Juneau: Cross-site request forgery via default-enabled content query-parameter body |
| CVE-2026-73100 | 10.0 CRITICAL | Apache Juneau: Sensitive request headers logged in cleartext by the default request logger |
| CVE-2026-73101 | 10.0 CRITICAL | Apache Juneau: Internal exception class and message disclosed via error response header an |
| CVE-2026-73116 | 10.0 CRITICAL | Apache Juneau: REST client forwards credentials to a different origin when following HTTP |
| CVE-2026-73117 | 10.0 CRITICAL | Apache Juneau: Response header CRLF injection and open redirect when applications set head |
| CVE-2026-96677 | 10.0 CRITICAL | Apache Juneau: Cross-site scripting via unescaped request variables in HTML-doc chrome |
| CVE-2026-121489 | 10.0 CRITICAL | Apache Juneau: Path traversal in DirectoryResource allows reading files outside the config |
| CVE-2026-73095 | 8.7 HIGH | Apache Juneau: Denial of service via unbounded memory allocation in parsers and REST reque |
| CVE-2026-103864 | Apache Sling Engine: Request-derived values reach log sinks without CR/LF neutralization | |
| CVE-2026-97355 | Apache OFBiz: Hard-coded Credentials in AdminServer Enable Unauthenticated Denial of Servi | |
| CVE-2026-109837 | Apache OFBiz: Authorization Bypass Through User-Controlled Key in Order Returns Enables Cr | |
| CVE-2026-109129 | Apache OFBiz: Authorization Bypass Through User-Controlled Key in OrderServices Enables Un | |
| CVE-2026-105461 | Apache OFBiz: Missing authorization in updateOrderItems allows view-only users to modify o | |
| CVE-2026-105330 | Apache OFBiz: Use of Hard-coded Cryptographic Key in JWT Token Authentication Enables Unau | |
| CVE-2026-105325 | Apache OFBiz: Missing authorization in payment application services allows view-only users | |
| CVE-2026-100228 | Apache OFBiz: Improper Input Validation in Order Returns Enables Unauthorized Refund Price | |
| CVE-2026-100168 | Apache OFBiz: Missing Authorization vulnerability | |
| CVE-2026-97356 | Apache OFBiz: Insufficiently Protected Credentials in ViewFile Enable Authentication Bypas | |
| CVE-2026-92887 | Apache OFBiz: REST API authentication bypassed by default when the auth attribute is omitt |
Showing top 20 of 58 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: Apache OFBiz
-
CVE-2026-66903
Apache OFBiz: Authenticated Path Traversal in Catalog Image -
CVE-2026-71901
Apache OFBiz: Dispatch arbitrary internal services on SFA co -
CVE-2026-68524
Apache OFBiz: Pre-Authentication Remote Code Execution via A -
CVE-2026-73577
Apache OFBiz: Unauthenticated path-suffix view authorization -
CVE-2026-73578
Apache OFBiz: Unauthenticated saved-view authorization bypas
Same vendor: Apache Software Foundation
-
CVE-2026-66903
Apache OFBiz: Authenticated Path Traversal in Catalog Image -
CVE-2026-71901
Apache OFBiz: Dispatch arbitrary internal services on SFA co -
CVE-2026-68524
Apache OFBiz: Pre-Authentication Remote Code Execution via A -
CVE-2026-73577
Apache OFBiz: Unauthenticated path-suffix view authorization -
CVE-2026-73578
Apache OFBiz: Unauthenticated saved-view authorization bypas
Same weakness: CWE-425
-
CVE-2026-100168
Apache OFBiz: Missing Authorization vulnerability -
CVE-2026-105325
Apache OFBiz: Missing authorization in payment application s -
CVE-2026-105461
Apache OFBiz: Missing authorization in updateOrderItems allo -
CVE-2026-109856
Apache OFBiz: Missing Authorization in Financial Account Ser -
CVE-2026-87744
Io.quarkus:quarkus-hibernate-orm-rest-data-panache: missing