Apache OFBiz CVE-2026-47342

Exploitation requires the attacker to hold a valid authenticated session on the target OFBiz instance with at least low-privilege permissions (CVSS PR:L), and the target must be a network-reachable Apache OFBiz deployment running any version before 24.09.07. No user interaction from a second user is required (UI:N), no special non-default configuration is called out by the advisory, and no specific OFBiz module is named as the prerequisite. Practical limits on exploitation are therefore the attacker's ability to obtain low-tier credentials - either via self-registration if enabled on the deployment, via existing customer/partner/employee accounts, or via credential reuse - and network reachability to the OFBiz web tier; deployments that disable self-registration and restrict the web tier to authenticated VPN users substantially shrink the exploitable population.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 8.8) describes a network-reachable, low-complexity bug requiring only a low-privileged account and no user interaction, with total impact on the OFBiz instance - consistent with SSVC Technical Impact: total. However, several signals temper urgency: EPSS is 0.02% (4th percentile), SSVC Exploitation status is 'none', CISA has not added the CVE to KEV, and no POC has been published in the references provided, so this is currently a high-severity-but-not-yet-actively-exploited issue. The realistic priority depends on exposure: internet-facing OFBiz deployments where self-registration or weak account provisioning is permitted should patch promptly, while internal deployments with tightly controlled accounts have a longer runway. No conflicts between sources were identified; the main missing datapoint is independent technical detail on which endpoint or service performs the broken authorization check.

An attacker who has obtained or registered a low-privileged OFBiz account (for example a customer, supplier, or limited employee login on an internet-facing storefront or partner portal) logs in over HTTPS and issues a crafted request to an endpoint whose authorization check is broken, causing OFBiz to execute the request under elevated privileges. This grants administrative control of the ERP instance, enabling theft of customer and financial data, manipulation of orders or accounting entries, and deployment of further footholds. No public exploit identified at time of analysis, but the low attack complexity and total technical impact make this an attractive target once a POC is released.