Apache OFBiz CVE-2026-73580

No authentication required: Apache OFBiz exposes the affected HR disclosure path to unauthenticated remote callers in all versions prior to 24.09.08, so any network-reachable OFBiz instance is exploitable until upgraded. The specific feature, endpoint, or request that triggers the HR organization and employee disclosure is not described in the available sources. The primary limiting factor is network exposure - instances not reachable by the attacker (internal-only, firewalled, or already upgraded to 24.09.08) are not affected; no non-default configuration is stated as a prerequisite.

No CVSS vector, EPSS score, KEV entry, or SSVC exploitation signal is provided for CVE-2026-73580 - the only priority signal is vuln.today's 'awaiting_data' label, so quantitative risk cannot be computed from the input and must be inferred from the description alone. The flaw is described by Apache as 'Unauthenticated HR organization and employee disclosure' in Apache OFBiz, which means a remote attacker needs no credentials to read HR organizational structure and employee records - an inherently lower-urgency impact than the several RCE and SQL-injection issues disclosed in the same advisory batch (e.g. CVE-2026-68524 pre-auth RCE, CVE-2026-105330 hard-coded JWT key). Realistically this is a confidentiality-only information-disclosure bug exposing potentially sensitive personnel/PII data, not code execution; it is a genuine concern for OFBiz operators because it is unauthenticated, but on its own it is a moderate-severity issue rather than a top-tier emergency. The decision label is explicitly 'awaiting_data', so treat exploitation likelihood as unestablished rather than low or high. No active exploitation and no exploit code are indicated in the input.

A remote, unauthenticated attacker sends requests to an exposed Apache OFBiz instance (version prior to 24.09.08) and retrieves HR organizational hierarchy and employee records without logging in, harvesting personnel data useful for social engineering or follow-on targeting. The exact request/endpoint that triggers the disclosure is not described in the available sources, and no public exploit code is referenced.