Question 1

What is CVE-2026-100228 — CVE-2026-100228?

Accepted Answer

Improper Input Validation in Order Returns in Apache OFBiz 24.09.07 on all platforms allows an authenticated user without the ORDERMGR_CREATE permission to persist an arbitrary price on a return item via the createReturnItem service, bypassing the intended server-computed price ceiling.

Question 2

What is the authoritative source for CVE-2026-100228?

Accepted Answer

CVE-2026-100228 (CVE-2026-100228) is catalogued in NVD + CISA KEV + FIRST EPSS and curated for EU compliance use cases by SQUR.

CVE-2026-100228CVE-2026-100228

Description

Scoring