What is the CVSS score of CVE-2026-31909?

CVE-2026-31909 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of Apache OFBiz are affected by CVE-2026-31909?

Apache OFBiz versions prior to 24.09.06 contain an information disclosure vulnerability allowing remote, unauthenticated attackers to access sensitive data.. A patch is available.

How to fix or mitigate CVE-2026-31909?

Within 24 hours, inventory all Apache OFBiz instances and document which run versions before 24.09.06, noting the sensitivity classification of data accessible through affected systems. Within 7 days, upgrade all affected deployments to version 24.09.06 or later, prioritizing production systems first. Within 30 days, complete testing and rollout across all environments, verify patch application through version checks, and update your asset management system to reflect the patched state.

Apache OFBiz CVE-2026-31909

EUVD-2026-30871 HIGH

Information Exposure (CWE-200)

2026-05-19 apache

GHSA-h87f-qhmq-v48m

Information Disclosure Apache Apache Ofbiz

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

7.5 HIGH

Unauthenticated network-reachable information disclosure with low complexity (AV:N/AC:L/PR:N/UI:N) causing high confidentiality loss but no integrity or availability impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 17:52 vuln.today

Patch available

May 19, 2026 - 11:16 EUVD

CVE Published

May 19, 2026 - 09:32 nvd

UNKNOWN (no severity yet)

CVE Published

May 19, 2026 - 09:32 cve.org

HIGH 7.5

DescriptionCVE.org

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache OFBiz.

This issue affects Apache OFBiz: before 24.09.06.

Users are recommended to upgrade to version 24.09.06, which fixes the issue.

AnalysisAI

Information disclosure in Apache OFBiz before 24.09.06 lets remote unauthenticated attackers retrieve sensitive data they should not be able to access (CWE-200). The flaw is network-reachable with low complexity and no authentication (CVSS 7.5, C:H), though no public exploit identified at time of analysis and the EPSS score is very low (0.02%). Impact is limited to confidentiality only, with no integrity or availability effect.

Technical ContextAI

Apache OFBiz is an open-source enterprise resource planning (ERP) suite built on Java, covering e-commerce, CRM, accounting, inventory, and manufacturing, typically deployed as a self-hosted web application. The CPE cpe:2.3:a:apache_software_foundation:apache_ofbiz confirms the Apache Software Foundation product across all versions up to the fix. The root cause is CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor), a class where the application returns or leaks data - such as internal records, configuration, or user data - to actors lacking authorization, generally through an endpoint that fails to enforce proper access control on the returned content. The public advisory and oss-security disclosure describe it only as sensitive information exposure; the exact leaking component is not detailed in the available data.

RemediationAI

Vendor-released patch: 24.09.06 - upgrade Apache OFBiz to version 24.09.06, which the Apache advisory states fixes the issue, per https://lists.apache.org/thread/0hpopzz1qrhkzsbt3ncofs6qo0545r2h. No official workaround is published in the available data; because the vulnerability is unauthenticated and network-reachable, if immediate upgrade is not possible, restrict network exposure of the OFBiz instance by placing it behind a VPN or firewall and limiting inbound access to trusted networks, and consider a reverse-proxy or WAF rule to block or restrict access to non-essential endpoints - with the trade-off that this may interrupt legitimate remote or e-commerce access and does not address the underlying leak. Upgrading remains the only confirmed fix. The oss-security disclosure is at http://www.openwall.com/lists/oss-security/2026/05/19/23.