Apache OFBiz CVE-2026-81744

The available description is a single-line title from a bulk advisory and does not state the triggering request, endpoint, or configuration. Based on that title, exploitation requires access to the content-permission functionality and abuses a missing authorization check so that a caller can assign the content OWNER role to their own account rather than being restricted to roles they are entitled to grant. The limiting factor is that the attacker appears to need an existing foothold/account on the OFBiz instance to perform the self-grant (inferred from 'self-grant', not confirmed by a CVSS vector), and the instance must be running a version prior to 24.09.08; the exact authorization state required is not confirmed from the available data.

Key risk signals are largely MISSING for this specific CVE, so confidence is limited. No CVSS vector or score is provided (NVD/vendor list it as N/A), no EPSS exploitation probability is supplied, there is no CISA KEV listing, and no public exploit was identified - the vuln.today Decision label is explicitly 'awaiting_data', signaling that scoring intelligence has not yet been populated. The only hard facts are the vulnerability class (authorization bypass allowing a user to self-grant the content OWNER role), the affected range (all versions prior to Apache OFBiz 24.09.08), and the fix. Contextually, this CVE was disclosed as one entry in a large batch of 40+ OFBiz vulnerabilities, several of which are far more severe (e.g., CVE-2026-68524 pre-authentication RCE and CVE-2026-105330 hard-coded JWT key enabling unauthenticated admin access); relative to those, a privilege-escalation-over-content issue that appears to require an existing account is a lower-tier priority. However, because no CVSS vector is available, the authentication requirement cannot be confirmed from data - the 'self-grant' wording implies a pre-existing session but this is inferred, not vendor-stated. Treat this as a real integrity-affecting authorization flaw to be remediated via the batch upgrade, but not as an isolated emergency on current evidence; the trigger mechanism is not described in the available sources.

A user who already has access to an Apache OFBiz instance invokes a content-permission operation that fails to check whether the caller is entitled to assign roles, and grants their own account the content OWNER role on content objects they should not control. With OWNER rights they can then read, modify, or administer that content. No public exploit was identified at time of analysis, and the exact trigger is not described in the available sources.