CVE-2026-109856

Name of the Vulnerable Software and Affected Versions Apache OFBiz versions 24.09 through 24.09.07

Description An authenticated user with low privileges can perform forced browsing to access financial account services. This allows the unauthorized creation, modification, and cancellation of financial account transactions and balances through direct requests to the following services: createFinAccount(), updateFinAccount(), deleteFinAccount(), createFinAccountTrans(), createFinAccountRole(), createFinAccountAuth(), setFinAccountTransStatus(), and depositWithdrawPayments().

Recommendations Upgrade to version 24.09.08.