Apache OFBiz EUVD-2026-117474

Requires an authenticated OFBiz session holding only the webtools base permissions OFBTOOLS_VIEW and WEBTOOLS_VIEW; the ENTITY_MAINT permission that the export feature advertises and refuses to render for is NOT required, because the XmlDsDump screen action writes entity data via new FileOutputStream on the unvalidated outpath and filename request parameters before the ENTITY_MAINT check runs. The attacker-controlled outpath/filename can target any filesystem path the OFBiz process can write, including a web-served docroot. Limiting factors: a valid low-privilege account with webtools access is mandatory (not anonymous), only Apache OFBiz 24.09 before 24.09.08 is affected, and impact at the chosen path is bounded by the OS write permissions of the OFBiz process; written file content is entity data rather than fully attacker-defined bytes.

The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N, score 7.1) indicates a network-reachable, low-complexity flaw requiring only low privileges and no user interaction, with high confidentiality impact driven by exposure of UserLogin currentPassword hashes. PR:L is consistent with the description: exploitation requires an authenticated account holding only the webtools base permissions (OFBTOOLS_VIEW, WEBTOOLS_VIEW), notably bypassing the ENTITY_MAINT permission the feature claims to enforce - a genuine authorization-bypass primitive rather than a theoretical issue. No EPSS score, CISA KEV listing, or POC/exploit reference is present in the input, so exploitation probability cannot be quantified and there is no public exploit identified at time of analysis; this tempers urgency relative to the high confidentiality impact. The vuln.today decision label is 'this_week', aligning with a real but not emergency priority: a credentialed attacker can dump password hashes and write to a web docroot, but the authentication requirement and absence of known exploitation argue for prompt scheduled patching rather than crisis response. Signals are internally consistent - no conflicting attack-vector/description mismatch - but the risk hinges on how freely low-privilege webtools accounts are granted in a given deployment.

A remote attacker who already holds a low-privileged OFBiz account with only OFBTOOLS_VIEW and WEBTOOLS_VIEW invokes the XmlDsDump screen action with crafted outpath and filename parameters. Because the FileOutputStream write runs before the ENTITY_MAINT permission check, they export the UserLogin entity (including currentPassword hashes) to a web-served docroot and then retrieve it over HTTP, or alternatively truncate an arbitrary file the OFBiz process can write. No public exploit is identified at time of analysis.