CVE-2026-100228: Apache OFBiz: Improper Input Validation in Order Returns Enables Unauthorized Refund Price Manipulation

Published Nov 5, 2026

Updated

Improper Input Validation in Order Returns in Apache OFBiz 24.09.07 on all platforms allows an authenticated user without the ORDERMGRCREATE permission to persist an arbitrary price on a return item via the createReturnItem service, bypassing the intended server-computed price ceiling. Users are recommended to upgrade to version 24.09.08, which fixes this issue.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Apache OFBiz to a version that resolves this vulnerability.
Fixed in 24.09.08

Event History

Nov 5, 2026

CVE Published

via MITRE·01:43 PM

Data Sourced

via MITRE·01:43 PM

DescriptionWeakness

Data Sourced

via NVD·02:16 PM

DescriptionWeakness

Frequently Asked Questions

Who can exploit this issue?

An authenticated Apache OFBiz user who does not have the ORDERMGR_CREATE permission can exploit it. The issue affects use of the createReturnItem service.

What is the impact of successful exploitation?

The attacker can persist an arbitrary price on a return item, bypassing the intended server-computed price ceiling. This can enable unauthorized manipulation of refund prices.

Which version should be deployed to remediate the issue?

Upgrade Apache OFBiz to version 24.09.08. The issue is reported in version 24.09.07 on all platforms.

CVE-2026-100228: Apache OFBiz: Improper Input Validation in Order Returns Enables Unauthorized Refund Price Manipulation

Remediation

Event History

Frequently Asked Questions

Who can exploit this issue?

What is the impact of successful exploitation?

Which version should be deployed to remediate the issue?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What is the impact of successful exploitation?

Which version should be deployed to remediate the issue?