Apache OFBiz CVE-2026-114233

Requires an authenticated Order Manager user who holds the ORDERMGR_VIEW permission but lacks ORDERMGR_UPDATE and has no role on the target order; the attacker invokes the updateShipGroupShipInfo and appendOrderItem services against an already-approved order. Limiting factors: a valid OFBiz account with at least order-view access is mandatory (PR:L, not anonymous), and exploitation is confined to the Order Manager component on Apache OFBiz 24.09 through 24.09.07 - default installations are vulnerable but only to users who can already reach the order services. No user interaction and no elevated admin privilege are needed.

The signals point to a moderate, prioritizable-but-not-emergency issue rather than a top-tier crisis. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N) describes a network-reachable, low-complexity flaw requiring only authenticated low privilege - specifically a user holding ORDERMGR_VIEW - which is realistic in multi-user commerce deployments. However, EPSS is very low at 0.18% (8th percentile), there is no CISA KEV listing, and no public exploit was identified in the provided references (which are vendor/oss-security advisories, not PoC code), indicating no evidence of active or widespread exploitation. The vuln.today decision label is 'this_week', consistent with a patch-available integrity flaw that deserves prompt but not emergency remediation. One notable tension: the input CVSS reports C:H and I:H and the tags include 'Information Disclosure', yet the description is almost entirely about unauthorized modification of approved orders (changing ship addresses, shipment methods, and appending items at overridden prices) - the real-world impact is integrity/fraud, not data disclosure, so the confidentiality rating appears overstated relative to the described mechanism. Net: a genuine privilege-boundary weakness exploitable by any semi-trusted back-office user, worth patching this cycle, but not a mass-exploitation threat.

A back-office user provisioned with only order-view rights (ORDERMGR_VIEW) and no update permission or role on a given order calls the updateShipGroupShipInfo or appendOrderItem services directly to alter an already-approved order - redirecting a shipment to an attacker-controlled address or adding items at a self-chosen price for fraud. Because the attack vector is network with low complexity and only low privilege is required, no user interaction or special timing is needed. No public exploit code was identified at time of analysis.