Description
Direct Request ('Forced Browsing') to Financial Account services in Apache OFBiz 24.09 before 24.09.08 on all platforms allows an authenticated user with any valid low-privilege account to create, modify, and cancel financial account transactions and balances without appropriate permission via direct requests to the createFinAccount, updateFinAccount, deleteFinAccount, createFinAccountTrans, createFinAccountRole, createFinAccountAuth, setFinAccountTransStatus, and depositWithdrawPayments services.

Users are recommended to upgrade to version 24.09.08, which fixes this issue.
Published: 2026-11-05
Score: n/a
EPSS: n/a
KEV: No
Impact: Unauthorized Financial Balance Manipulation
Action: Immediate Patch
AI Analysis

Impact

Apache OFBiz version 24.09 before 24.09.08 permits authenticated users with low privileges to create, modify, and cancel financial account transactions and balances without proper authorization through direct service calls. This flaw can lead to unauthorized alteration of financial records, subverting the integrity of the system's accounting data.

Affected Systems

Apache Software Foundation’s Apache OFBiz product, specifically releases 24.09 through 24.09.07 on all platforms. Version 24.09.08 and later contain the fix.

Risk and Exploitability

The vulnerability can be exploited by any user who has a valid low‑privilege account, as no additional authentication is required beyond reaching the services. Although an EPSS score is not available and the issue is not listed in CISA KEV, the potential for financial misconduct is high, presenting a significant risk to data integrity if the flaw remains unpatched.

Generated by OpenCVE AI on November 5, 2026 at 14:21 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Apache OFBiz to version 24.09.08 or later, which addresses the authorization failure.
  • Audit existing financial transactions and balances for potential unauthorized changes made prior to patch deployment.
  • Limit the permissions of low‑privilege user accounts to prevent access to financial account services until the patch is applied.

Generated by OpenCVE AI on November 5, 2026 at 14:21 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 05 Nov 2026 13:45:00 +0000

Type Values Removed Values Added
Description Direct Request ('Forced Browsing') to Financial Account services in Apache OFBiz 24.09 before 24.09.08 on all platforms allows an authenticated user with any valid low-privilege account to create, modify, and cancel financial account transactions and balances without appropriate permission via direct requests to the createFinAccount, updateFinAccount, deleteFinAccount, createFinAccountTrans, createFinAccountRole, createFinAccountAuth, setFinAccountTransStatus, and depositWithdrawPayments services. Users are recommended to upgrade to version 24.09.08, which fixes this issue.
Title Apache OFBiz: Missing Authorization in Financial Account Services Enables Unauthorized Balance Manipulation
Weaknesses CWE-425
References

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: apache

Published:

Updated: 2026-11-05T13:37:35.534Z

Reserved: 2026-10-13T08:07:05.503Z

Link: CVE-2026-109856

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-11-05T14:17:00.200

Modified: 2026-11-05T14:48:26.210

Link: CVE-2026-109856

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-11-05T14:30:08Z

Weaknesses
  • CWE-425

    Direct Request ('Forced Browsing')