Apache OFBiz CVE-2026-105461

Exploitation requires an authenticated Apache OFBiz account that holds the ORDERMGR_VIEW permission within the Order Manager application; the server's order-update code path omits the ORDERMGR_UPDATE permission check, so any such view-only user can perform updates. The limiting factor is that the attacker must already possess valid credentials with at least ORDERMGR_VIEW access - this is not an anonymous/unauthenticated flaw despite the input's PR:N rating, so the realistic risk is privilege escalation by existing low-privilege internal users or compromised view-only accounts rather than open internet exploitation. Affected on all versions before 24.09.08.

This is a broken-authorization flaw (CWE-425) in Apache OFBiz where the ordermgr component fails to verify the ORDERMGR_UPDATE permission, so an account holding only ORDERMGR_VIEW can modify orders. The signals are mixed. The input CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N, 7.5) scores it as unauthenticated network-exploitable with high integrity impact, but the description explicitly states the actor must be a 'user with only ORDERMGR_VIEW permission' - i.e. an authenticated low-privilege user - which contradicts PR:N; verify authentication requirements with the vendor advisory, as the real privilege requirement appears to be PR:L, not PR:N. The real-world exploitation signals are low and consistent: EPSS is 0.15% (4th percentile), there is no CISA KEV listing, and no public exploit or PoC is referenced - only advisories. The vuln.today decision label is 'this_week' rather than act_now/emergency, matching a patch-available integrity bug with no observed exploitation. Net: this is a legitimate privilege/authorization defect worth patching on a normal cycle, not a high-CVSS issue masking low risk, but also not an actively-exploited emergency; the headline 7.5 overstates reach because real exploitation requires a valid OFBiz account with order-viewing access.

An authenticated OFBiz user who was granted only read access to the Order Manager (ORDERMGR_VIEW) sends an order-update request; because the server never checks for ORDERMGR_UPDATE, the update succeeds and the user alters order data they should only be able to view. No public exploit code is identified, and the network attack vector with low complexity means the request itself is trivial once a low-privilege account is available.