Loading vulnerability…
Cross-Party Order Item Authorization Bypass in Apache OFBiz Order Returns
CVE-2026-109837 is an authorization bypass through a user-controlled key in Order Returns in Apache OFBiz 24.09 releases before 24.09.08 on all platforms. The createReturnItem service allows an authenticated user with low-privileged Order Manager access to associate another party's OrderItem with a ReturnItem on a ReturnHeader they control, bypassing party-level authorization boundaries.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
An authenticated, low-privileged user can create unauthorized associations between another party's order items and returns under their control, compromising the integrity of order-return records.
If you can’t patch tonight, do this now.
No interim mitigation or workaround is specified.
Patch, then assume compromise.
Upgrade Apache OFBiz to version 24.09.08, which fixes this vulnerability.
No public exploits tracked yet. Mallory keeps watching.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.