Apache OFBiz CVE-2026-84728

Requires an Apache OFBiz instance running in multitenant mode with domain-to-tenant ('mapped-domain') login configured - this is a non-default deployment, which is the primary limiting factor. The flaw concerns the login/tenant-resolution path crossing a tenant authorization boundary; however, the exact precondition (whether a valid account in some tenant is needed, or the specific configuration setting) is not described in the available sources. Exploitation is limited to multitenant deployments; single-tenant OFBiz installations are not affected by a cross-tenant bypass. Authentication requirements are not confirmed from available data because no CVSS vector is provided.

Signal quality for this specific CVE is poor: no CVSS vector, CWE, EPSS score, CISA KEV listing, or PoC reference is provided, and the vuln.today Decision label is 'awaiting_data', so no quantitative exploitation-probability or decision-framework (SSVC) signal is available to weigh. What is known is qualitative only: CVE-2026-84728 is described as a 'Cross-tenant authorization bypass in mapped-domain login' in Apache OFBiz, part of a large batch of OFBiz fixes shipped in 24.09.08. Because no CVSS vector is supplied, authentication requirements cannot be confirmed from data - the title says 'login' and 'cross-tenant', which implies the flaw lets an actor reach a tenant other than the one they are authorized for, but whether any prior authentication is needed is not stated. This is also fundamentally a multitenant-mode issue: OFBiz multitenancy with domain-to-tenant mapping is not a default deployment, which sharply narrows the exposed population. Net: treat as a real authorization-boundary defect worth patching for anyone running OFBiz multitenant mode, but there is no evidence (no KEV, no EPSS, no confirmed PoC) of active or imminent widespread exploitation. Several key fields are missing or conflicting-by-absence - STATE EXPLICITLY: severity and attack vector are unrated by any source, so the real-world priority cannot be fully scored from available data and should be verified against the vendor advisory.

In an OFBiz deployment running multitenant mode with domains mapped to tenants, an attacker interacts with the mapped-domain login path and abuses the tenant-resolution logic so that the session or authorization context is bound to a tenant the attacker should not reach, exposing or acting on another tenant's data. The precise trigger is not described in the available sources, and no public exploit is identified at time of analysis. Realistic only where multitenant mode with domain mapping is actually configured.