Apache OFBiz CVE-2026-83538

The affected product is Apache OFBiz at any version prior to 24.09.08, with the exposure reachable through HR, Catalog, and Order Manager 'helper' request endpoints. The title indicates no authentication is required, but because no CVSS vector is supplied this cannot be confirmed from the available data - authentication requirements are not confirmed. The specific helper paths, required parameters, and the exact data returned are not described in the available sources. The primary limiting factor is network reachability of the OFBiz web application: instances not exposed to the attacker's network, or fronted by access controls, are not reachable. The only stated complete fix is upgrading to 24.09.08.

Signal availability for this specific CVE is sparse: no CVSS vector, no EPSS score, no CISA KEV listing, and no SSVC/automatable determination are provided - the aggregator's own Decision label is 'awaiting_data', meaning priority has not yet been computed. CVE-2026-83538 is one entry in a large bundled Apache OFBiz advisory (40+ CVEs fixed in 24.09.08) and is described as unauthenticated information disclosure reachable through HR, Catalog, and Order Manager helper endpoints. The vulnerability title asserts unauthenticated access, which - if accurate - makes this network-reachable with no credentials and therefore attractive for low-effort data harvesting; however, this is drawn from the title text, not from a CVSS PR:N metric, so the authentication requirement is not independently confirmed from the available data. Impact appears limited to confidentiality (disclosure) with no stated integrity or availability effect, so despite a potentially low barrier to exploitation this is a data-exposure issue rather than a code-execution or takeover issue. Note the same bundle contains far more severe companions (e.g. CVE-2026-68524 pre-auth RCE, CVE-2026-105330 hard-coded JWT key) that should outrank this CVE for remediation urgency even though a single upgrade to 24.09.08 fixes them all. No exploitation probability or active-exploitation signal is available to distinguish real-world priority; treat current severity as provisional pending a vendor/NVD CVSS vector.

An attacker who can reach an internet-exposed Apache OFBiz instance sends requests directly to HR, Catalog, or Order Manager helper endpoints and receives back internal business data (such as employee, catalog, or order information) without supplying credentials. No public exploit code is identified for this specific CVE at the time of analysis, and the precise request format and exact data exposed are not described in the available sources.