CVE-2026-109856 in OFBiz
Summary
by MITRE • 11/05/2026
Direct Request ('Forced Browsing') to Financial Account services in Apache OFBiz 24.09 before 24.09.08 on all platforms allows an authenticated user with any valid low-privilege account to create, modify, and cancel financial account transactions and balances without appropriate permission via direct requests to the createFinAccount, updateFinAccount, deleteFinAccount, createFinAccountTrans, createFinAccountRole, createFinAccountAuth, setFinAccountTransStatus, and depositWithdrawPayments services.
Users are recommended to upgrade to version 24.09.08, which fixes this issue.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 11/05/2026
The vulnerability identified in Apache OFBiz versions prior to 24.09.08 represents a critical failure in access control mechanisms within the financial account management subsystem. This flaw allows authenticated users possessing any valid low-privilege account to perform sensitive operations on financial data without holding the necessary administrative permissions. The core issue stems from insufficient authorization checks when handling direct requests to specific service endpoints responsible for managing financial accounts and their associated transactions. By exploiting this weakness, an attacker can bypass intended security boundaries that are supposed to restrict such actions to users with elevated privileges or specific role assignments dedicated to financial administration.
The technical flaw manifests through the ability of a low-privilege user to directly invoke services such as createFinAccount, updateFinAccount, deleteFinAccount, and several transaction-related endpoints including createFinAccountTrans, setFinAccountTransStatus, and depositWithdrawPayments. These services are designed to handle critical financial operations that should require strict validation of user roles against defined permission sets. However, the implementation fails to verify whether the authenticated session possesses the requisite authority before executing these commands. This oversight enables an adversary with minimal access rights to create new financial accounts, modify existing account details and balances, cancel transactions, and manipulate payment statuses. The absence of proper role-based access control checks at the service layer allows for unauthorized manipulation of financial records that should be protected by higher-level security policies.
The operational impact of this vulnerability is severe due to its direct effect on financial integrity and data confidentiality. An attacker can alter account balances, potentially leading to fraudulent transactions or misrepresentation of financial status within the application. The ability to create new accounts or roles could allow an adversary to establish backdoors for persistent access or further privilege escalation by assigning themselves higher privileges through role manipulation. Furthermore, the capability to cancel or modify transaction statuses disrupts audit trails and compromises the reliability of financial reporting systems that rely on accurate historical data. This level of unauthorized control undermines trust in the system's ability to safeguard sensitive economic information and can result in significant monetary loss for organizations relying on Apache OFBiz for their enterprise resource planning needs.
From a classification perspective, this vulnerability aligns with CWE-284 Improper Access Control, specifically reflecting failures where access controls are not properly enforced during direct object references or service invocations. It also corresponds to ATT&CK technique T1078 Valid Accounts, as the exploitation requires valid authentication credentials but leverages them to perform actions outside their intended scope. The attack vector involves Direct Request manipulation, often categorized under forced browsing patterns where users attempt to access resources by guessing URLs or endpoint names without proper authorization checks. This highlights a common architectural weakness in web applications where business logic services are exposed directly without adequate middleware validation of user permissions relative to the requested action.
To mitigate this risk, organizations running Apache OFBiz versions earlier than 24.09.08 must upgrade immediately to version 24.09.08 or later, which includes patches addressing these authorization gaps. In addition to upgrading, administrators should review and enforce strict role-based access control policies ensuring that financial services are only accessible by users with explicitly granted permissions. Implementing additional monitoring for unusual patterns in service invocations can help detect potential exploitation attempts. Regular security audits focusing on authentication and authorization logic across all exposed endpoints are essential to prevent similar vulnerabilities from being introduced or remaining undetected in future updates.