Apache OFBiz CVE-2026-109837

Exploitation targets the Order Returns feature of Apache OFBiz and relies on manipulating a user-controlled key/identifier to associate OrderItems across party boundaries; the deployment must run the Order Manager / returns component. Authentication requirements are not confirmed from the available data (no CVSS vector), but the 'user-controlled key' authorization-bypass class implies the attacker needs an active OFBiz session/account from which to submit a return request. Limiting factors: the account/session prerequisite, the need for the returns workflow to be in use, and the fact that impact is confined to order/return data rather than host or code execution. The exact parameter and trigger are not described in the available sources.

No CVSS vector, EPSS score, KEV listing, or SSVC technical-impact decision is present in the supplied data - the vuln.today Decision label is explicitly 'awaiting_data', so quantitative risk signals cannot be compared or contrasted. Risk must therefore be reasoned from the CVE title and the batch Apache OFBiz advisory alone. CVE-2026-109837 is an Authorization Bypass Through User-Controlled Key (an IDOR-class flaw, consistent with CWE-639) in the Order Returns flow that lets a request associate OrderItems across party boundaries; its direct impact is integrity of order/return data (potential fraudulent returns or refund manipulation) rather than system compromise. This is a meaningfully lower-severity issue than other entries disclosed in the same advisory - notably CVE-2026-68524 (pre-auth RCE) and CVE-2026-105330 (hard-coded JWT key enabling unauthenticated admin access) - which are the true priorities in this bundle. Authentication requirements cannot be confirmed because no CVSS vector was provided; the 'user-controlled key' class strongly implies an authenticated session is needed, but this is inferred, not confirmed. Overall this reads as a real but moderate data-integrity bug that should be remediated as part of the 24.09.08 upgrade, not as a standalone emergency - though that judgement is provisional because the authoritative scoring data is missing (awaiting_data).

An OFBiz user interacting with the Order Returns functionality tampers with a user-controlled identifier so that OrderItems belonging to a different party are associated with their own return request, enabling cross-party manipulation such as returning or claiming refunds against another customer's order items. No public exploit code is identified for this specific CVE in the supplied data, and the exact trigger is not described in the available sources.