Apache OFBiz CVE-2026-31388

Exploitation requires that the target Apache OFBiz instance is deployed in multi-tenant mode - the vulnerability is explicitly scoped to multi-tenant deployments per the CVE description; single-tenant instances are not identified as affected. Beyond this configuration requirement, no authentication is required (PR:N), no user interaction is needed (UI:N), and network access suffices (AV:N), making the attack straightforward against any exposed multi-tenant instance. The primary limiting factor is the multi-tenant deployment mode, which narrows the exposed population relative to the total OFBiz install base. Confidentiality impact is bounded (C:L), meaning attackers gain only partial information access rather than full data exfiltration capability.

The NVD-assigned CVSS 5.3 Medium score reflects a network-accessible, low-complexity, unauthenticated attack with limited confidentiality impact and no integrity or availability impact. This is broadly consistent with the description - a cross-tenant information disclosure without write or disruption capability. EPSS at 0.02% (4th percentile) is markedly low, indicating minimal observed exploitation activity in the wild at time of analysis. SSVC signals a mixed picture: Exploitation is 'none' (corroborating the low EPSS), but Automatable is 'yes', meaning a successful exploit could be scripted at scale against exposed instances, and Technical Impact is rated 'partial', aligning with C:L. No POC code has been identified and the vulnerability is not listed in CISA KEV. Taken together, this vulnerability represents a real but currently low-priority issue: real-world risk is meaningfully constrained to multi-tenant deployments, and there is no evidence of active targeting. The automatable nature warrants timely patching over emergency response.

An unauthenticated remote attacker sends crafted HTTP requests to a publicly exposed Apache OFBiz instance operating in multi-tenant mode, exploiting the access control bypass to cross tenant boundaries and read limited confidential data belonging to another tenant. No POC exploit code has been identified at time of analysis, but the SSVC assessment of Automatable:Yes indicates that such requests could be scripted and run at scale against internet-exposed OFBiz deployments.