CVE-2026-105461

HighCVSS 7.5/10Last modified Nov 10, 2026

Description

Missing check for  ORDERMGR_UPDATE in ordermgr allows user with only ORDERMGR_VIEW permission to update orders.

Affected versions before : 24.09.08

Users are recommended to upgrade to version 24.09.08 which fixes this issue.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-425

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published
Nov 5, 2026
Last modified
Nov 10, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-1054648.8IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 for Linux, UNIX and Windows (includes DB2 Connect Server) could allow a local attacCVE-2026-1054658.8IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 is vulnerable to privilege escalation when db2locssh is enabled with the db2 instanCVE-2026-1054666.5IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 is vulnerable to a denial of service when inserting into a table with XML columns uCVE-2026-1054678.1IBM QRadar 7.5.0 through 7.5.0 Update Pack 16 Interim Fix 02, and 7.6.0.0 through 7.6.0.5 is vulnerable to Reflected XSS. A victim must openCVE-2026-1054687.3A vulnerability was found in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5. This affects the CVE-2026-1054697.3A vulnerability was determined in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5. This vulneraCVE-2026-105478.1IBM Langflow OSS 1.0.0 through 1.10.3 does not properly validate ownership in the deprecated POST /api/v1/build/{flow_id}/vertices endpoint,CVE-2026-1054707.3A vulnerability was identified in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5. This issue aCVE-2026-1054717.3A security flaw has been discovered in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5. ImpacteCVE-2026-1054726.3A weakness has been identified in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5. The affectedCVE-2026-1054734.6IBM QRadar 7.5.0 through 7.5.0 Update Pack 16 Interim Fix 02, and 7.6.0.0 through 7.6.0.5 is vulnerable to Open Redirect. A victim must openCVE-2026-1054749.4A server-side template injection exists in SolusVM 2 up to version 2.0.0-44576 that allows remote authenticated users to execute arbitrary c
CVE-2026-105461: High severity, CVSS 7.5 | Vulnix