Apache OFBiz EUVD-2026-117486

Exploitation requires an authenticated session on Apache OFBiz (version prior to 24.09.08) with the ability to reach the imageCrop and imageRotate catalog-image services; the advisory's 'missing authorization check' wording indicates that no additional catalog-write role is enforced, so lower-privilege or view-only accounts may suffice rather than a catalog administrator. The concrete prerequisite is the ability to call these two services with a controllable file-path argument that is not properly restricted to the image directory. Limiting factors: a valid login is still needed (this is not pre-auth), the issue is confined to the imageCrop/imageRotate code paths, and the exact path parameter and whether the impact is arbitrary read versus arbitrary overwrite are not specified in the available sources; all deployments below 24.09.08 are in scope.

Real-world risk for CVE-2026-76152 must be assessed almost entirely on structural reasoning, because the quantitative signals are absent: no CVSS vector or score is provided (listed N/A), there is no EPSS exploitation-probability value, the vulnerability is not on the CISA KEV catalog, and the vuln.today Decision label is 'awaiting_data' - meaning the priority tooling itself has not yet reached a verdict. The only exploitation-relevant inputs are the advisory title and the fixed-version note. The advisory classifies this as an 'Authenticated path traversal and missing authorization check in imageCrop and imageRotate services,' which points to a moderate-severity, post-authentication flaw in Apache OFBiz's catalog image handling rather than a pre-auth critical issue (unlike its sibling CVE-2026-68524, a pre-auth RCE in the same advisory). Because no CVSS vector is supplied, the authentication requirement cannot be formally confirmed from scored metrics - it is asserted only by the advisory's own title, so it should be treated as advisory-stated rather than metric-confirmed. The 'missing authorization check' element is the aggravating factor: it suggests that even low-privilege or view-only accounts may be able to invoke the affected services, lowering the practical privilege bar below a trusted-administrator level. Net assessment: this is a credible, patch-worthy issue for any OFBiz operator but, on current data, not an emergency in isolation - with no EPSS, no KEV listing, no public exploit, and an 'awaiting_data' decision, it reads as a priority-to-remediate-with-the-release rather than a drop-everything item. Key caveat: the entire severity read is inferred from the title; verify exact privilege level and file-system impact against the Apache OFBiz advisory before final triage.

An attacker holding a valid but low-privilege OFBiz account (or any account that can reach the catalog image tooling) invokes the imageCrop or imageRotate service and supplies a file-path parameter containing directory-traversal sequences. Because an authorization check is missing, the service processes the request even for users who should not have catalog write access, letting the attacker read or overwrite files outside the intended image directory. No public exploit has been identified at time of analysis, and the precise triggering parameter and traversal mechanics are not described in the available sources.