What is the CVSS score of CVE-2026-45187?

CVE-2026-45187 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-45187?

Yes, a patch is available for CVE-2026-45187. Update the affected software to the latest version immediately.

Apache OFBiz CVE-2026-45187

EUVD-2026-30874 MEDIUM

Improper Authorization (CWE-285)

2026-05-19 apache

GHSA-fhwf-wmm8-vr9w

Authentication Bypass Apache Apache Ofbiz Apache Software Foundation

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

vuln.today AI

6.5 MEDIUM

Webtools is network-exposed with no authentication barrier (PR:N, AV:N); partial confidentiality and integrity impact reflects authorization bypass scope with no availability impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 17:51 vuln.today

Patch available

May 19, 2026 - 11:16 EUVD

CVE Published

May 19, 2026 - 09:39 nvd

UNKNOWN (no severity yet)

CVE Published

May 19, 2026 - 09:39 cve.org

MEDIUM 6.5

DescriptionCVE.org

Improper Authorization vulnerability in Apache OFBiz Webtools.

This issue affects Apache OFBiz: before 24.09.06.

Users are recommended to upgrade to version 24.09.06, which fixes the issue.

AnalysisAI

Improper Authorization in Apache OFBiz Webtools allows unauthenticated remote attackers to bypass access controls and gain partial read and write access to restricted resources. All OFBiz releases before 24.09.06 are affected. No public exploit code has been identified and the vulnerability is not listed in CISA KEV, though SSVC flags it as automatable - meaning scripted mass-scanning is feasible once a technique is published.

Technical ContextAI

Apache OFBiz is an open-source Java-based ERP framework; its Webtools component provides administrative, debugging, and development utilities surfaced over HTTP. CWE-285 (Improper Authorization) indicates the application performs authentication but then fails to enforce authorization policy correctly - requests for protected Webtools resources are not adequately checked against the caller's permission set before granting access. The affected scope per CPE (cpe:2.3:a:apache_software_foundation:apache_ofbiz:*:*:*:*:*:*:*:*) covers every published OFBiz release up to but not including 24.09.06. The CVSS vector AV:N/AC:L/PR:N/UI:N confirms the flaw is reachable without credentials over a standard network path with no complexity barriers.

RemediationAI

The primary fix is to upgrade Apache OFBiz to version 24.09.06 or later, as confirmed by the Apache Software Foundation advisory at https://lists.apache.org/thread/pcmfyxjyk7dg0btxqg9h7cr30yg8mr7k and the Openwall disclosure at http://www.openwall.com/lists/oss-security/2026/05/19/28. If an immediate upgrade is not feasible, restrict network access to the Webtools endpoint (/webtools/ URL path) via a reverse proxy or WAF rule to trusted internal IP ranges only - this directly addresses the AV:N exposure but does not fix the underlying authorization flaw and must be treated as a temporary measure. Disabling the Webtools application entirely in production environments is a stronger compensating control with the trade-off that administrative and diagnostic tooling will be unavailable.