Loading vulnerability…
Missing authorization in Apache OFBiz payment application services
CVE-2026-105325 is a missing authorization vulnerability in the accounting payment application services of Apache OFBiz versions before 24.09.08. The affected services do not enforce ACCOUNTING_CREATE and ACCOUNTING_UPDATE permission checks when creating or updating PaymentApplication records. Authenticated users with only ACCOUNTING_VIEW permission can therefore modify payment allocations despite having read-only accounting access.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
View-only accounting users can create or modify PaymentApplication records without the required write permissions, compromising the integrity of payment allocations and associated accounting records.
Patch, then assume compromise.
Upgrade Apache OFBiz to version 24.09.08, which fixes the missing authorization checks.
No public exploits tracked yet. Mallory keeps watching.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.