Loading vulnerability…
Missing Authorization in Apache OFBiz Financial Account Services
CVE-2026-109856 is a missing authorization vulnerability in Apache OFBiz 24.09 releases before 24.09.08 on all platforms. An authenticated user with any valid low-privilege account can bypass financial-account permissions by directly requesting vulnerable services, a technique known as forced browsing. Affected services include createFinAccount, updateFinAccount, deleteFinAccount, createFinAccountTrans, createFinAccountRole, createFinAccountAuth, setFinAccountTransStatus, and depositWithdrawPayments. Exploitation allows unauthorized creation, modification, and cancellation of financial-account transactions and manipulation of balances.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation compromises the integrity of financial-account records by allowing users without appropriate financial permissions to create, modify, or cancel transactions and manipulate balances. These unauthorized changes can undermine financial record accuracy and business processes that depend on those records.
Patch, then assume compromise.
Upgrade Apache OFBiz to version 24.09.08, which fixes the missing authorization checks.
No public exploits tracked yet. Mallory keeps watching.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.