CVE-2026-114271

MediumCVSS 6.5/10Last modified Nov 10, 2026

Description

Authorization Bypass Through User-Controlled Key in the shopping list services in Apache OFBiz 24.09 before 24.09.08 on all platforms allows an authenticated low-privileged user, such as a self-registered ecommerce customer, to modify another party's shopping list or take ownership of it, and thereby read its contents, via a request to the shopping list update endpoint that supplies the other party's shopping list ID.

Users are recommended to upgrade to version 24.09.08, which fixes this issue.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-639

Affected software

VendorProductVersions
Apache Software FoundationApache OFBiz< 24.09.08

References

Timeline

Published
Nov 5, 2026
Last modified
Nov 10, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-1142726.5Authorization Bypass Through User-Controlled Key in the content viewing component in Apache OFBiz 24.09 before 24.09.08 on all platforms allCVE-2026-1142776.5Authentication bypass by Assumed-Immutable data vulnerability in Apache OFBiz. Apache OFBiz's optional Janrain Engage Social Login integratiCVE-2026-1142789.8The che-machine-exec service constructs a shell command by concatenating user-controlled input (the username and namespace fields from the /CVE-2026-1142910.0Two endpoints in the Vault Service ScriptsController, shared by Altium Enterprise Server and Altium 365, accept file uploads where a user-suCVE-2026-11438.8A weakness has been identified in TOTOLINK A3700R 9.1.2u.5822_B20200513. This affects the function setWiFiEasyGuestCfg of the file /cgi-bin/CVE-2026-114307.3Grav CMS's scheduler-webhook plugin contains an authentication bypass in the webhook token check. When the webhook feature is enabled but noCVE-2026-114318.3A path traversal vulnerability exists in the Projects Service download endpoint shared by Altium Enterprise Server and Altium 365. An authenCVE-2026-114342.4A weakness has been identified in FluentCMS 0.0.5. The impacted element is an unknown function of the file /admin/blocks of the component BlCVE-2026-1143485.3webpack-dev-server is a development server that provides live reloading for webpack projects. In versions from 5.1.0 before 5.2.7 and in verCVE-2026-1143496.5When a broker decodes a compressed record batch, the per-record decoder reads a declared body size from the decompressed stream and allocateCVE-2026-114357.3A security vulnerability has been detected in Jinher OA 1.0. This affects an unknown function of the file nextselectplan.aspx. Such manipulaCVE-2026-1143537.0Hidden functionality (undocumented backdoor) in the root-privileged 'assistant' daemon in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0
CVE-2026-114271: Medium severity, CVSS 6.5 | Vulnix