{"affected":[{"defaultStatus":"unaffected","product":"Apache OFBiz","source":"CNA: apache","vendor":"Apache Software Foundation","versions":[{"lessThan":"24.09.08","status":"affected","version":"0","versionType":"semver"}]}],"cveId":"CVE-2026-105325","cwes":["CWE-425"],"description":"Missing check for  ACCOUNTING_UPDATE /  ACCOUNTING_CREATE in accounting in allows user with only ACCOUNTING_VIEW permission to update/create PaymentApplication.\n\nAffected versions before : 24.09.08\n\nUsers are recommended to upgrade to version 24.09.08 which fixes this issue.","epss":null,"exploits":[],"kev":null,"metrics":[],"modifiedAt":1793886035583,"publishedAt":1793886035583,"references":[{"source":"CNA: apache","tags":["vendor-advisory"],"url":"https://lists.apache.org/thread.html/7b2syzksp7klt9fvhdg0olldvs2g83lz"}],"remediation":[],"revision":"c05ea3a76f3bc7a97666a2ac9261dfad0a6ce61fa93be12f33ac75cd9232456b","sources":[{"modifiedAt":1793886035583,"name":"CNA: apache","retrievedAt":1793887726925,"url":"https://www.cve.org/CVERecord?id=CVE-2026-105325"}],"ssvc":null,"status":"published","title":"Apache OFBiz: Missing authorization in payment application services allows view-only users to modify payment allocations","updatedAt":1793887726925}