Apache OFBiz CVE-2026-71901

Exploitation requires an authenticated OFBiz user who has access to the SFA (Sales Force Automation) component and can invoke its vcard import feature; the attacker then supplies an attacker-chosen service identifier so the import calls a different, unauthorized service. The limiting factors are that valid credentials with SFA access are mandatory (PR:L, confirming an authenticated attacker), and the abuse is specific to the vcard import service-override path rather than a default unauthenticated endpoint. All versions before 24.09.08 are affected; upgrading to 24.09.08 is the vendor's stated fix.

This is a genuine but conditional priority rather than a drop-everything emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N) describes a network-reachable, low-complexity flaw with no user interaction, but it explicitly requires privileges (PR:L) - an already-authenticated user with access to the SFA (Sales Force Automation) component. The 8.1 High score is driven by high confidentiality and integrity impact (C:H/I:H) with no availability impact (A:N). The vuln.today Decision label is 'this_week', and the vendor has shipped a patch, which together argue for prompt but scheduled remediation rather than crisis response. There is no CISA KEV listing and no EPSS probability supplied in the input, and the references are advisories (oss-security, Apache lists, NVD) rather than exploit code, so there is no public exploit identified at time of analysis. The practical risk is bounded by the authentication requirement: an attacker must first hold a valid OFBiz account with SFA access before they can abuse the vcard import service override. No signals conflict here - the network vector is consistent with OFBiz being a web-facing application, and the PR:L requirement is consistent with the description's 'authenticated user' language. EPSS and KEV data were simply not provided and should not be read as either high or low exploitation likelihood.

An attacker who already holds a valid Apache OFBiz account with access to the SFA component uses the vcard import function to override which backend service is invoked, redirecting the import to an unintended internal service. This lets them reach and operate services they were not authorized to call, exposing or altering data (C:H/I:H). No public exploit code was identified, and exploitation requires authenticated access, so the scenario presumes a malicious or compromised low-privileged user.