CVE-2026-105325: Apache OFBiz: Missing authorization in payment application services allows view-only users to modify payment allocations

Published Nov 5, 2026

Updated

Missing check for ACCOUNTINGUPDATE / ACCOUNTINGCREATE in accounting in allows user with only ACCOUNTINGVIEW permission to update/create PaymentApplication.

Affected versions before : 24.09.08

Users are recommended to upgrade to version 24.09.08 which fixes this issue.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Apache OFBiz to a version that resolves this vulnerability.
Fixed in 24.09.08

Event History

Nov 5, 2026

CVE Published

via MITRE·01:40 PM

Data Sourced

via MITRE·01:40 PM

DescriptionWeakness

Data Sourced

via NVD·02:16 PM

DescriptionWeakness

Frequently Asked Questions

Which users are able to exploit this issue?

Users who have only the ACCOUNTING_VIEW permission can update or create PaymentApplication records because the required ACCOUNTING_UPDATE or ACCOUNTING_CREATE authorization checks are missing.

Which OFBiz versions are affected?

Versions before 24.09.08 are affected. Upgrading to 24.09.08 fixes the issue.

What should be done if immediate upgrade is not possible?

The provided information does not identify a workaround. Restrict ACCOUNTING_VIEW access to users who should not be able to modify payment allocations until the upgrade can be applied.

CVE-2026-105325: Apache OFBiz: Missing authorization in payment application services allows view-only users to modify payment allocations

Remediation

Event History

Frequently Asked Questions

Which users are able to exploit this issue?

Which OFBiz versions are affected?

What should be done if immediate upgrade is not possible?

Company

Resources

Contact

Frequently Asked Questions

Which users are able to exploit this issue?

Which OFBiz versions are affected?

What should be done if immediate upgrade is not possible?