Apache OFBiz suffers from a missing authorization check in the order management subsystem, allowing any authenticated user with the ORDERMGR_VIEW permission to invoke updateOrderItems and alter the price or quantity of existing orders. By bypassing the required ORDERMGR_UPDATE privilege, an attacker can modify order details, potentially causing financial loss or inventory mismanagement. The flaw represents a serious privilege escalation vulnerability, mapped to CWE-425.

This vulnerability applies to installations of Apache OFBiz from the Apache Software Foundation that are running any version older than 24.09.08. The recommended remedy is to upgrade to Apache OFBiz 24.09.08 or newer, which includes the authorization fix.

No CVSS or EPSS score is provided for this entry, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be via the web or REST API interface of the order management component; any user possessing a view‑only role can exploit the flaw after authenticating. Because the prerequisite is merely an existing user account with ORDERMGR_VIEW, the barrier to exploitation is low, and the impact can be high if financial or inventory data are abused.