Apache OFBiz CVE-2026-73578

The specific prerequisite is reaching OFBiz's view-rendering path (RequestHandler.renderView) as an anonymous/unauthenticated user and supplying a crafted _LAST_VIEW_NAME_ parameter that is persisted as saved-view state in the anonymous session, which is then re-rendered without re-applying the original view's request-map authentication requirement. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N) no authentication, no user interaction, and no special non-default configuration are stated as required. The principal LIMITS are: (1) version scope - only Apache OFBiz 24.09 before 24.09.08 is affected; (2) impact is confined to confidentiality (C:H, I:N, A:N) - it exposes protected views and associated business data but does not allow modification or service disruption; and (3) exposure is bounded to those protected views reachable through the saved-view mechanism.

This is a genuine but moderate-priority issue rather than an emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, 7.5) and the description agree cleanly: a remote, unauthenticated attacker over the network, with low complexity and no user interaction, can bypass the request-map authentication policy - there is no conflict between the vector and the narrative here (contrast with cases where a network vector contradicts a local-access description). Impact is confidentiality-only (C:H, I:N, A:N): protected views and associated business data can be exposed, but no data modification or availability loss is implied. The signals pointing down are consistent with each other: EPSS is 0.33% (26th percentile), there is no CISA KEV listing, and no public exploit or PoC reference appears in the provided input - only vendor/advisory references. The vuln.today decision label is 'this_week', which aligns with a patch-available, moderate-severity information-disclosure flaw rather than 'act_now'/'emergency'. Net assessment: real and worth patching on a normal cycle, but currently low observed-exploitation pressure; the low EPSS plus absence of KEV/PoC suggests no widespread active exploitation at this time.

A remote unauthenticated attacker interacts with an OFBiz 24.09 instance (24.09.x before 24.09.08) and supplies a crafted _LAST_VIEW_NAME_ value that is stored as saved-view state in their anonymous session; on a subsequent request OFBiz renders that saved view without re-applying the target view's authentication requirement, returning a protected view and its business data. No public exploit code is identified in the provided sources, so this reflects the mechanism described in the advisory rather than a confirmed weaponized exploit. Low attack complexity and no required privileges or user interaction make the scenario straightforward against affected versions.