What is the CVSS score of CVE-2026-31388?

CVE-2026-31388 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-31388?

Yes, a patch is available for CVE-2026-31388. Update the affected software to the latest version immediately.

Apache OFBiz CVE-2026-31388

EUVD-2026-30867 MEDIUM

Improper Access Control (CWE-284)

2026-05-19 apache

GHSA-48vq-7h22-vf29

Authentication Bypass Apache Apache Ofbiz Apache Software Foundation

5.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

vuln.today AI

5.3 MEDIUM

Network-accessible unauthenticated bypass with no complexity barrier beyond multi-tenant deployment; only partial confidentiality impact, no integrity or availability consequence.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 17:53 vuln.today

Patch available

May 19, 2026 - 11:16 EUVD

CVE Published

May 19, 2026 - 09:28 nvd

UNKNOWN (no severity yet)

CVE Published

May 19, 2026 - 09:28 cve.org

MEDIUM 5.3

DescriptionCVE.org

Improper Access Control vulnerability in Apache OFBiz in multi-tenant deployments.

This issue affects Apache OFBiz: before 24.09.06.

Users are recommended to upgrade to version 24.09.06, which fixes the issue.

AnalysisAI

Improper Access Control in Apache OFBiz multi-tenant deployments exposes confidential data across tenant boundaries to unauthenticated remote attackers via a network-accessible flaw (AV:N/PR:N). All versions prior to 24.09.06 are affected, limited to multi-tenant configurations. No active exploitation has been confirmed (not in CISA KEV), and the EPSS score of 0.02% at the 4th percentile indicates very low observed exploitation interest at time of analysis, though the attack is automatable per SSVC assessment.

Technical ContextAI

Apache OFBiz is an open-source Enterprise Resource Planning (ERP) and e-commerce framework maintained by the Apache Software Foundation. The affected product is identified by CPE cpe:2.3:a:apache_software_foundation:apache_ofbiz:*:*:*:*:*:*:*:*. The root cause is CWE-284 (Improper Access Control), a class of vulnerabilities where the software fails to restrict access to resources or functionality in a manner consistent with its security policy - in this case, failing to enforce tenant isolation boundaries in multi-tenant mode. The tags 'Authentication Bypass' indicate the access control mechanism can be circumvented without credentials, consistent with the PR:N CVSS metric. The confidentiality impact (C:L) suggests partial, bounded information disclosure rather than full data exfiltration.

RemediationAI

Upgrade Apache OFBiz to version 24.09.06 or later, which includes the vendor-released fix per the Apache advisory at https://lists.apache.org/thread/npjchvnpnosoqpto46s2om12jd9s7py7. This is confirmed as a vendor-released patch for version 24.09.06. If an immediate upgrade is not feasible, organizations running multi-tenant OFBiz deployments should consider disabling multi-tenant functionality if operationally possible - this removes the attack surface entirely but eliminates tenant-separation capabilities. Alternatively, restricting network access to OFBiz tenant-switching or management endpoints via firewall rules or reverse proxy ACLs can reduce exposure, though this may impact legitimate tenant workflows. There are no documented workarounds that fully substitute for the patch.