Apache OFBiz CVE-2026-82894

Exploitation requires that a Content row's serviceName field has been populated to an attacker-chosen service by an account holding only CONTENTMGR_CREATE or CONTENTMGR_UPDATE permission; the subsequent trigger is an unauthenticated remote request (PR:N) to the public showHelpPublic view, which causes ContentWorker.renderContentAsText to resolve and invoke that persisted service with parameters taken directly from the live HTTP request map (no allow-list, no ownership check, no authentication). Limiting factors: the deployment must be running Apache OFBiz 24.09 before 24.09.08, the exposed showHelpPublic/content handling path must be reachable, and crucially a privileged content-manager action must already have set the malicious serviceName - without that pre-populated client-writable field there is no attacker-controlled service to invoke. No end-user interaction is required.

Signals are moderately consistent and point to a real but not top-tier emergency priority. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes a network-reachable, low-complexity, unauthenticated flaw scored 7.5 with integrity-only impact (C:N/I:H/A:N) - note the vector sets A:N even though the description explicitly includes arbitrary file deletion, which would normally carry an availability impact, so the official scoring appears to understate real impact. EPSS is low at 0.46% (40th percentile), indicating no broad, automated exploitation is currently predicted, and the vulnerability is NOT on CISA KEV, so there is no confirmed active exploitation. The vuln.today decision label is 'this_week', consistent with a serious unauthenticated integrity flaw that is not yet weaponized. There is a tension in the data worth flagging: the description frames the attacker as 'remote unauthenticated', yet exploitation is gated by a persisted precondition - a Content row whose serviceName field must already have been set (by an account holding CONTENTMGR_CREATE or CONTENTMGR_UPDATE) to an attacker-chosen service. This operator/data precondition is not reflected in the PR:N scoring and materially narrows real-world exploitability. No SSVC automatable/technical-impact fields and no POC verification status were supplied. Net: a genuine high-severity issue warranting prompt patching within the week, not a mass-exploitation emergency given low EPSS, no KEV, and a non-trivial configuration precondition.

In an OFBiz 24.09 deployment where a low-privileged content manager (CONTENTMGR_CREATE/UPDATE) has populated a Content row's serviceName field, a remote unauthenticated attacker requests the public showHelpPublic view against that row; ContentWorker.renderContentAsText resolves the attacker-influenced service name and builds parameters directly from the live HTTP request map, letting the attacker invoke arbitrary OFBiz services to write or delete files or coerce server-side requests (SSRF). No public exploit is identified at time of analysis, and the attack requires the pre-existing writable serviceName condition plus low complexity otherwise (AC:L).