Threats tagged 'ghsa-7483-w5v4-rgq7'

1 threat

Severity	CVSS	Threat	Source	Published	Score and star
High	–	CVE-2026-114233Apache OFBiz · Incorrect Privilege Assignment High2026-11-05GCVE DatabaseCVE-2026-114233 Incorrect Privilege Assignment in the Order Manager in Apache OFBiz 24.09 before 24.09.08 on all platforms allows an authenticated user who holds only order view permissions (ORDERMGR_VIEW), without ORDERMGR_UPDATE or any role on the order, to modify approved orders, changing a ship group's shipping address and shipment method or appending items with an overridden price, via the updateShipGroupShipInfo and appendOrderItem services. Users are recommended to upgrade to version 24.09.08, which fixes this issue. Report on CVE-2026-114233 Vulnerability CWE-266 #ghsa-7483-w5v4-rgq7	GCVE Database	2026-11-05

Page 1 of 1