Name: CVE-2026-105461: Apache Software Foundation Apache OFBiz: Missing check for ORDERMGR_UPDATE in ordermgr allows user with only ORDERMGR_VIEW permission to update orders
Creator: Rapid7
Published: 2026-11-05T00:00:00.000Z
License: https://www.rapid7.com/legal/website-terms-of-use/
Keywords: CVE, CVE-2026-105461, CWE-425

Missing check for ORDERMGR_UPDATE in ordermgr allows user with only ORDERMGR_VIEW permission to update orders.

Affected versions before : 24.09.08

Users are recommended to upgrade to version 24.09.08 which fixes this issue.

Prioritize with Active Threat Intelligence

With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.

Explore Intelligence Hub

MDR Buyer's Guide

Global Threat Landscape Report

Prioritize with Active Threat Intelligence