Apache OFBiz CVE-2026-114271

Exploitation requires access to the Apache OFBiz Shopping List functionality and, per the 'cross-party' wording, a valid user account whose request can reference a shopping-list key (identifier) belonging to another party that the application fails to authorize against the requester. The specific endpoint, parameter name, and whether any role beyond a basic authenticated account is needed are not described in the available sources. Limiting factors: affects only Apache OFBiz versions prior to 24.09.08; impact is confined to shopping-list data integrity rather than full system compromise; authentication requirements are implied by the title but not confirmed by any CVSS vector in the input.

No CVSS vector, EPSS score, KEV entry, or SSVC parameters are supplied for CVE-2026-114271; the only priority signal is vuln.today's Decision label 'awaiting_data', so this is an unscored item pending enrichment rather than a confirmed high-severity emergency. The vulnerability is an Authorization Bypass Through User-Controlled Key (an IDOR-class flaw) in Apache OFBiz Shopping Lists that lets one party modify another party's shopping list, which is a classic missing-object-ownership-check issue. Real-world risk is moderate at best: the title scopes impact to shopping-list data integrity (cross-party modification), not to code execution, data exfiltration at scale, or account takeover - unlike the much more severe pre-auth RCE and auth-bypass issues bundled in the same OFBiz advisory (e.g. CVE-2026-68524, CVE-2026-105330). Authentication requirements cannot be confirmed from CVSS because no vector was provided; however, 'cross-party modification' and 'user-controlled key' strongly imply a logged-in user acting against another user's data, which the CVSS section cannot corroborate. Because key data (CVSS, EPSS, KEV, POC) is entirely missing, treat any severity characterization as provisional and verify with the Apache OFBiz security advisory once per-CVE scoring is published.

An authenticated OFBiz user submits a request to a shopping-list operation while substituting a shopping-list identifier (or associated party key) that belongs to a different customer; because the server trusts the user-controlled key without verifying ownership, the attacker modifies the victim's shopping list. No public exploit identified at time of analysis, and the attack path above is inferred from the vulnerability class and title rather than from a described trigger.