Apache OFBiz CVE-2026-81734

The attacker must be able to reach the catalog quick-admin product-write functionality in Apache OFBiz; the flaw is that the authorization check on these product write operations is missing, so an actor who lacks proper catalog-management privileges can nonetheless perform product writes. This affects all OFBiz versions prior to 24.09.08. Limiting factor: the 'missing authorization' classification implies the actor needs some level of access/session to the application rather than purely anonymous reach, but this is not confirmed by a CVSS vector, and the exact request path, required session state, and trigger are not described in the available sources.

Signal availability for CVE-2026-81734 is very thin: no CVSS vector or score was provided (input shows CVSS Score N/A, Vector N/A), no EPSS probability is given, the CVE is NOT on CISA KEV, and no proof-of-concept or exploit reference is present. The vuln.today Decision label is 'awaiting_data', which matches this gap - there is no decision signal pushing urgency and no signal downplaying it either. Based on the weakness class alone (missing authorization on catalog quick-admin product writes), this is a broken-access-control integrity issue rather than a direct code-execution flaw, so in isolation it reads as a moderate-priority issue, not a drop-everything emergency. Important caveat: this CVE was disclosed as one line item in a large bulk Apache OFBiz advisory that ALSO contains several critical pre-auth RCE entries (e.g. CVE-2026-68524, CVE-2026-83542, CVE-2026-105330); organizations should prioritize patching to 24.09.08 for the bundle as a whole even though THIS specific CVE's severity signals are missing. Do not treat the absence of EPSS/KEV/PoC as evidence of low real risk - it reflects incomplete data, not a confirmed low-risk verdict.

An attacker with a low-privilege OFBiz account that should not have catalog-management rights reaches the catalog quick-admin product-write functionality, where the server-side authorization check is missing, and submits product write operations. Because the authorization enforcement is absent, the attacker can create or modify catalog product data they were never authorized to touch. No public exploit code or PoC reference is present in the provided sources, and the precise request/trigger is not described.