Apache OFBiz CVE-2026-109856

Exploitation requires the ability to invoke Apache OFBiz Financial Account services (the balance-affecting service calls); the flaw is a missing authorization check on those services, so an actor who can reach the endpoint can manipulate account balances without holding the proper privilege. The specific service parameters and whether a valid session is required are not detailed in the available batch advisory, and no CVSS vector is provided to confirm the privilege level - the limiting factor is reachability of the Financial Account service layer, which in typical OFBiz deployments means an operator/user able to call the service rather than an anonymous external request. Fix is upgrade to 24.09.08; the vendor states upgrading is the remediation.

No CVSS vector, EPSS score, or SSVC technical-impact data is supplied for CVE-2026-109856, and it is not listed in CISA KEV, so the quantitative exploitation signals are absent and the vuln.today decision label is explicitly 'awaiting_data' - this is a priority that cannot yet be scored from the available intelligence, not a confirmed high-urgency item. What IS known is the vulnerability class: 'Missing Authorization in Financial Account Services Enables Unauthorized Balance Manipulation' (CWE-862), disclosed as part of a large Apache OFBiz batch advisory covering many issues fixed in 24.09.08. The real-world risk is an integrity-impacting authorization flaw: a user able to reach the Financial Account service endpoints can alter account balances they should not control, which has direct financial/fraud consequences in an ERP/e-commerce deployment. Because no CVSS vector is provided, authentication requirements are not confirmed from the available data; the 'Missing Authorization' framing implies an actor who can already invoke the service rather than a fully pre-auth attacker, but this should be verified against the Apache advisory. There is no EPSS/KEV/POC evidence of active or widespread exploitation, so urgency should track the vendor advisory and the batch nature of the fix rather than confirmed in-the-wild activity.

An actor with access to Apache OFBiz Financial Account service endpoints invokes a balance-affecting service that fails to enforce an authorization check, letting them adjust a financial account balance they are not entitled to modify - for example inflating store credit or a gift/deposit balance for fraudulent benefit. No public exploit code or PoC reference is provided in the available sources, and the exact trigger is not described in the batch advisory.