CVE-2026-100228

{"id": "CVE-2026-100228", "cveTags": [], "metrics": {}, "affected": [{"source": "security@apache.org", "affectedData": [{"vendor": "Apache Software Foundation", "product": "Apache OFBiz", "versions": [{"status": "affected", "version": "0", "lessThan": "24.09.08", "versionType": "semver"}], "defaultStatus": "unaffected"}]}], "published": "2026-11-05T14:16:58.863", "references": [{"url": "https://lists.apache.org/thread.html/7b2syzksp7klt9fvhdg0olldvs2g83lz", "source": "security@apache.org"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Primary", "source": "security@apache.org", "description": [{"lang": "en", "value": "CWE-20"}]}], "descriptions": [{"lang": "en", "value": "Improper Input Validation in Order Returns in Apache OFBiz 24.09.07 on all platforms allows an authenticated user without the ORDERMGR_CREATE permission to persist an arbitrary price on a return item via the createReturnItem service, bypassing the intended server-computed price ceiling. Users are recommended to upgrade to version 24.09.08, which fixes this issue."}], "lastModified": "2026-11-05T14:48:26.210", "sourceIdentifier": "security@apache.org"}