Apache OFBiz CVE-2026-114235

The attacker must be able to send a request directly to the Apache OFBiz Order Manager function that updates an order's tracking number, which the advisory indicates is reachable without the expected authorization enforcement. The specific prerequisite - whether a valid low-privilege session is required or the endpoint is reachable unauthenticated - is not described in the available sources and cannot be confirmed because no CVSS vector was supplied. Limiting factors: the impact is confined to modifying tracking-number data on orders (no stated confidentiality or availability effect), and only deployments running a version prior to 24.09.08 with the Order Manager component in use are affected.

No quantitative signals are available to triage this issue: the input supplies no CVSS vector, no EPSS probability, no SSVC technical-impact decision, and the vuln.today decision label is explicitly 'awaiting_data'. It is NOT in CISA KEV and no public exploit or PoC reference is provided, so there is no evidence of exploitation. Based on the CVE title alone - 'Direct Request in Order Manager Enables Unauthorized Tracking Number Modification' (a forced-browsing / missing-authorization weakness, CWE-425 class) - the real-world impact appears to be a bounded integrity issue (altering shipment tracking numbers on orders), not code execution or data disclosure. This is a markedly lower-priority item than several sibling CVEs disclosed in the same Apache OFBiz advisory (e.g. CVE-2026-68524 pre-auth RCE, CVE-2026-105330 hard-coded JWT key). Because no CVSS vector was provided, authentication requirements cannot be confirmed from the available data and should be treated as unverified; the one-line title does not state the trigger, endpoint, or required privilege, so verify specifics against the Apache advisory before final rating.

An attacker who can reach the Order Manager's tracking-number update function issues a direct (forced-browsing) request to that endpoint, which fails to properly verify the caller's authorization, and overwrites the shipment tracking number on an order they should not be permitted to modify. No public exploit code or PoC was identified at the time of analysis, and the exact request and required privilege level are not described in the available sources.