Apache OFBiz EUVD-2026-117469

Exploitation requires a valid authenticated OFBiz account that holds both the OFBTOOLS_VIEW and CONTENTMGR_VIEW permissions (normally read-oriented roles), reachable over the network via the authenticated showContent route. The attack also depends on OFBiz-specific internals being present and reachable: the vulnerable updateLayout simple-method in LayoutEvents.xml, an existing RESPONSE-purpose Content record to relink, the ability to select an arbitrary DataResource and convert it to an OFBIZ_FILE/FTL resource, and the OFBiz access log being writable with attacker-controlled data via the User-Agent header so the FTL payload is later evaluated. Limiting factors: this is not anonymous - the attacker must already be logged in with those two specific permissions, and only the 24.09 branch before 24.09.08 is affected, so patched instances and deployments that do not grant these view permissions to untrusted users are not exposed.

This is a genuinely high-priority authorization flaw (CVSS 8.8), not a paper tiger. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H describes network-reachable, low-complexity exploitation requiring only low privileges, with full confidentiality, integrity and availability impact - consistent with the description's outcome of arbitrary command execution as the OFBiz process user. The CWE-863 (Incorrect Authorization) root cause is confirmed by the description: updateLayout checks only the fixed CONTENT_CREATE operation instead of validating update permission on the actual Content record and the independently selected DataResource, so a user holding only the read-oriented OFBTOOLS_VIEW and CONTENTMGR_VIEW permissions can escalate to full RCE. Key signals are MISSING or weak: no EPSS score was provided, so exploitation probability cannot be quantified; the CVE is NOT listed in CISA KEV; and no confirmed public exploit code was supplied - only an oss-security advisory and vendor references. The vuln.today priority is 'this_week', which aligns with a high-severity authenticated-RCE that is not yet known to be actively exploited. The main tension is PR:L versus the real-world bar: exploitation requires an authenticated account that already holds two specific permissions, which reduces the exposed population to organizations granting those content/tools view roles to semi-trusted users - a meaningful limiter not captured by the raw score.

A low-privilege but authenticated OFBiz user holding OFBTOOLS_VIEW and CONTENTMGR_VIEW sends a request with a malicious FreeMarker (FTL) payload in the User-Agent header, which is written into the OFBiz access log. They then abuse updateLayout's flawed authorization check to relink an existing RESPONSE-purpose Content record and convert an attacker-chosen DataResource into an OFBIZ_FILE/FTL resource pointing at that poisoned access log, and finally request the content through the normal authenticated showContent route to have the FTL evaluated, executing arbitrary commands as the OFBiz process user. No public exploit code was identified in the provided data; the chain is derived from the vendor description, and AV:N/AC:L make exploitation straightforward once the required permissions are held.