Apache OFBiz CVE-2026-82912

Requires an authenticated OFBiz account on an affected 24.09 instance (24.09 before 24.09.08) holding the OFBTOOLS_VIEW and ACCOUNTING_VIEW permissions - the two view-level permissions that open the Accounting application, so a low-privilege accounting user suffices rather than an administrator. The attacker must submit a ${groovy:...} expression as the bodyText or subject value to the shipped 'Send Per Email' invoice form; no non-default configuration, plugin, or special deployment mode is named as a prerequisite, and the service and request-map impose no permission check beyond base authentication. The limiting factors are therefore valid credentials plus those two view permissions and network reach to the Accounting UI; there is no user-interaction requirement on a victim.

All severity signals align on high priority: the CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 8.8) describes a network-reachable, low-complexity flaw needing no user interaction, and the technical impact is full arbitrary OS command execution as the OFBiz service account - complete C/I/A compromise. The one mitigating factor in the raw vector is PR:L (authentication required), but the description weakens even that: the two required permissions (OFBTOOLS_VIEW and ACCOUNTING_VIEW) are the standard view-level permissions that open the Accounting application, so any ordinary accounting user - not just an administrator - can reach the vulnerable 'Send Per Email' form, and the service and request-map declare no permission check beyond base authentication. The vuln.today Decision label is 'this_week', indicating prompt remediation is warranted. Key exploitation-probability signals are MISSING from the input: no EPSS score, no CISA KEV listing, and no PoC/exploit reference are provided, so active-exploitation likelihood cannot be quantified from the data at hand. This is a genuine high-risk RCE on its merits (trivially exploitable by a low-privilege internal or credentialed attacker), not a high-CVSS-but-low-real-risk issue, though the absence of EPSS/KEV/PoC data means spread and active-exploitation status are currently unknown rather than confirmed.

A user (or an attacker with stolen credentials) holding only the OFBTOOLS_VIEW and ACCOUNTING_VIEW permissions logs into OFBiz, opens the shipped 'Send Per Email' invoice form in the Accounting application, and places a ${groovy:...} expression in the subject or bodyText field. When sendMailFromScreen passes that value through FlexibleStringExpander.expandString, the embedded Groovy is compiled and evaluated without the SecureASTCustomizer restrictions used elsewhere, running arbitrary operating-system commands as the account running OFBiz. No public exploit was identified in the provided data, but the advisory describes the exact trigger field and code path precisely.