Apache OFBiz EUVD-2026-117444

Exploitation requires reaching OFBiz's content-viewing functionality and supplying an attacker-chosen key/identifier that references content owned by another party, where the server fails to verify the requester is authorized for that key (a classic user-controlled-key authorization bypass). The exact endpoint, parameter name, and HTTP request are not described in the available sources. Limiting factors: the title implies a valid session/account rather than a purely anonymous request (no 'Unauthenticated' qualifier is present, unlike sibling CVEs in the same advisory), and impact is confined to content disclosure - no write/modification or code execution is indicated for this CVE. Authentication requirement cannot be confirmed because no CVSS vector is provided; verify with the vendor.

Signals for this specific CVE are sparse and must be read against a near-total absence of scoring data: no CVSS vector, no EPSS probability, no CISA KEV listing, and no PoC reference are supplied, and the aggregator Decision label is 'awaiting_data' - so no priority ranking has been established yet. On mechanism alone (CWE-639-style authorization bypass through a user-controlled key leading to unauthorized content disclosure) this is a confidentiality-only issue and is materially less severe than several siblings disclosed in the same Apache advisory - notably the pre-authentication RCE chains (CVE-2026-68524, CVE-2026-83542) and the hard-coded JWT key granting unauthenticated admin access (CVE-2026-105330) - which are the real emergency items in this batch. Because the CVSS vector is missing, authentication requirements cannot be confirmed from scoring data; the title's 'user-controlled key' framing and the absence of an 'Unauthenticated' qualifier (which other CVEs in this batch carry explicitly) imply a logged-in user manipulating an identifier, but this is inferred, not confirmed. Net: treat as a genuine but lower-tier authorization/IDOR disclosure flaw whose true severity depends on the sensitivity of the exposed content, which the advisory does not quantify - verify affected content types with the vendor. Do not elevate on raw curiosity; prioritize the RCE and admin-access CVEs in the same bulletin first.

An actor with access to OFBiz content-viewing functionality supplies an identifier (key) referencing content belonging to another party and, because the authorization check does not bind the key to the requester, receives content they are not entitled to see. No public exploit or PoC is identified for this specific CVE at time of analysis; the exact request, parameter, and content scope are not described in the available sources.