What is the CVSS score of CVE-2026-100168?

CVE-2026-100168 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.2%.

How to fix or mitigate CVE-2026-100168?

Within 24 hours, inventory all Apache OFBiz instances across the estate, identify owners and business functions each supports, and determine which are internet-facing or exposed to third parties; restrict external access to these systems at the network edge as a precaution. Within 7 days, confirm the exact version of each deployment against the advisory threshold of 24.09.08 (all prior versions are in scope), engage the vendor or community for clarification on the affected service and endpoint since the advisory does not specify them, and increase monitoring for anomalous authenticated activity, privilege changes, and unusual data access on OFBiz systems. Within 30 days, upgrade all instances to Apache OFBiz 24.09.08 or later once validation testing is complete, apply least-privilege and network segmentation controls around OFBiz until then, and track the CVE for updated advisory detail to refine exposure assessment.

Apache OFBiz CVE-2026-100168

Q: Which versions of Apache OFBiz are affected by CVE-2026-100168?

A critical missing-authorization flaw affects Apache OFBiz, an open-source enterprise resource planning platform that many organizations use to run order management, accounting, and customer-facing…. A patch is available.

EUVD-2026-117461 MEDIUM

Direct Request ('Forced Browsing') (CWE-425)

2026-11-04

GHSA-59cr-x47x-655x

Apache Information Disclosure

6.5

CVSS 3.1 · Vendor

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Reach affected OFBiz function
Exploit

Invoke operation lacking authorization check
Impact

Perform unauthorized action or data access

Vulnerability Assessment

Weakness	CWE CWE-425 OWASP Top 10:2025 A01:2025 - Broken Access Control ASVS 5.0 V8 - Authorization Direct request prevention
Exploitation Conditions	The specific prerequisites are not described in the available sources - the batch advisory labels CVE-2026-100168 only as a 'Missing Authorization vulnerability' in Apache OFBiz without naming the affected service, endpoint, configuration, or deployment mode. Authentication requirements are not confirmed from available data because no CVSS vector or per-CVE detail was supplied. The only confirmed limiting factor is version: deployments on Apache OFBiz 24.09.08 or later are not affected, so exploitation is limited to instances running a version prior to 24.09.08.
Impact	Signal coverage for CVE-2026-100168 is thin and the vuln.today decision label is 'awaiting_data', so most risk inputs are simply absent. No CVSS vector, no EPSS probability, no SSVC decision, no CISA KEV listing, and no PoC/exploit reference are provided for this specific CVE - the only hard facts are that it is a Missing Authorization flaw (CWE-862 class) in Apache OFBiz affecting all versions prior to 24.09.08, disclosed as part of a large batch oss-security announcement. Because the shared advisory covers ~45 OFBiz CVEs at once (several of them critical pre-auth RCE issues), 100168 risks being over-ranked by association; on its own evidence it is a missing-authorization issue whose scope and privilege impact are undescribed. Key data is missing rather than conflicting: without a CVSS vector I cannot confirm whether exploitation is network- or locally-reachable, nor whether it requires authentication, and without EPSS/KEV I have no exploitation-likelihood signal. Treat this as 'needs vendor/NVD enrichment before prioritization' rather than a confirmed high or low priority - the real-world risk of the broader OFBiz bundle is driven by the critical pre-auth RCE CVEs, not by this entry in isolation.
Exploit ScenarioDerived	An attacker interacts with an Apache OFBiz function that fails to enforce an authorization check and performs an action or accesses data they should not be permitted to. The exact feature, endpoint, and whether any login is required are not described in the available sources, and no public exploit code or PoC reference is provided for this CVE.

This Month Plan within 30 days. Why: MEDIUM severity (CVSS 4.0-6.9).

Patch available 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Nov 04, 2026

Missing authorization in Apache OFBiz affects all versions prior to 24.09.08, according to a batch oss-security advisory that identifies CVE-2026-100168 only by that label and does not name the vulnerable service, endpoint, or configuration. The available sources indicate no public exploit identified at time of analysis, and no KEV, EPSS, CVSS, or CWE data was supplied for this specific CVE.

RemediationAI

Vendor-released patch: 24.09.08. Upgrade Apache OFBiz to 24.09.08, which the advisory states addresses CVE-2026-100168 along with the other listed vulnerabilities. No per-CVE workaround, configuration change, or compensating control is described for this specific missing-authorization issue; the advisory only directs users to upgrade. Advisory: https://seclists.org/oss-sec/2026/q4/516.

Affected VersionsENISA

Apache OFBiz 0 <24.09.08

Affected Packages

euvd apache_ofbiz fix: 24.09.08

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

Apache OFBiz is a Java-based web framework with an entity engine, a service engine, and a widget-based UI. The advisory labels CVE-2026-100168 as a missing authorization vulnerability, but the specific authorization check, component, and CWE mapping are not provided, so the trigger is not described in the available sources. Authentication requirements are not confirmed from available data, and the only confirmed boundary is that Apache OFBiz 24.09.08 and later are outside the affected version range.

Know when the next one hits your stack

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (CNA) PRIMARY 6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Primary rating from Vendor (CNA) · only source for this CVE.

CVSS VectorVendor

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

CVSS changed

Nov 10, 2026 - 17:22 NVD

6.5 (MEDIUM)

Patch available

Nov 05, 2026 - 15:17 EUVD

CVE Published

Nov 04, 2026 - 16:33 oss-security

CRITICAL

Description PRE-NVD

Disclosed via oss-security. NVD scoring and full description are pending.

Articles & Coverage 1

News 44 New Java Vulnerabilities - 40 Critical, 4 High Severity Nov 05, 2026

Executive ViewAI

Why It Matters

A critical missing-authorization flaw affects Apache OFBiz, an open-source enterprise resource planning platform that many organizations use to run order management, accounting, and customer-facing commerce functions. Because the vulnerable component and configuration are not yet identified in available advisory data, organizations running OFBiz cannot reliably scope exposure, meaning any internet-facing or partner-integrated deployment should be treated as potentially at risk until further detail emerges. Leadership should care because OFBiz frequently sits on transaction and financial data paths, so an authorization bypass could expose or permit manipulation of business-critical records.

Business Impact: High

Compensating Controls

No vendor-released patch identified at time of analysis. Interim mitigations include restricting network access to OFBiz instances (especially internet-facing deployments), enforcing least-privilege accounts and strong authentication, segmenting OFBiz from sensitive data stores, and enhancing monitoring for unauthorized access or privilege anomalies until remediation guidance or a fixed release is confirmed.

Threat Intelligence Overview

EPSS Score

0.2%

Top 92% exploitable

Prevalence

Low

niche open-source Java ERP/e-commerce framework, limited enterprise footprint

Data Quality

4 sources

Confidence: Medium

EUVD

NVD

CVE.org

EPSS

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity MEDIUM

CISA KEV No

Public POC No

EPSS 0.2%

Patch available Yes

Active threat No

Deciding rule

MEDIUM severity (CVSS 4.0-6.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Scheduled

Exploitation· derived

None

System Exposure· derived

Open

Automatable· derived

Human Impact

High

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +32

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.