Apache OFBiz CVE-2026-92887

The condition is specific: a REST API operation or resource whose .rest.xml definition (resource or operation element) omits the auth attribute, which ModelApiReader resolves to false instead of the true default declared by rest-api.xsd - effectively leaving that operation unauthenticated. Exploitation requires network reachability to the OFBiz REST API framework on versions through 24.09.07. Limiting factors: only operations that actually omit the auth attribute are exposed (operations with an explicit auth attribute are unaffected), and realized impact is bounded (CVSS C:L/I:L/A:L), so the blast radius depends on which operations a deployment defines without the attribute; no user interaction or authentication is required (PR:N/UI:N).

This is a genuine but moderate-priority issue, and the signals are internally consistent rather than conflicting. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes a remotely reachable, low-complexity flaw requiring no privileges and no user interaction - matching CWE-306 (Missing Authentication) and the description's claim that a missing auth attribute in a .rest.xml definition is incorrectly resolved to false, letting an unauthenticated remote attacker invoke REST API operations. The 7.3 (High) score is driven by the easy network reachability combined with limited C:L/I:L/A:L impact, meaning any single operation yields only partial confidentiality, integrity, and availability impact rather than full system compromise. Counterbalancing signals point to lower real-world urgency: EPSS is 0.22% (13th percentile), there is no CISA KEV listing in the input, and no public exploit or PoC reference is present - only vendor/advisory links. The vuln.today decision label is 'this_week' rather than act_now/emergency, consistent with the low EPSS and absence of confirmed exploitation. Net: a real authentication-bypass bug worth patching promptly, but current evidence indicates no active or widespread exploitation. One caveat: actual severity depends on which REST operations a given deployment exposes without the auth attribute, which the CVE does not enumerate - impact could be higher or lower per installation.

An attacker who can reach an OFBiz instance's REST endpoint over the network sends a request to a REST API operation whose .rest.xml definition omits the auth attribute; because ModelApiReader defaults that omitted attribute to false instead of the schema-declared true, the operation executes without credential validation. No public exploit code is identified at time of analysis, and the realistic impact depends on which specific operations are defined without an explicit auth attribute. Given AV:N/AC:L/PR:N/UI:N, exploitation needs only network access to the REST API.