EUVD-2026-117492
GHSA-qrqw-hm9g-pvrw
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify public OFBiz control request
-
DeliveryAppend protected view as path suffix
-
ExploitServlet authorizes on public path
-
ExecutionProtected view renders to attacker
-
ImpactDisclose restricted information
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Alternate path authentication
|
| Exploitation Conditions | No special conditions beyond network reachability - remote unauthenticated exploitation (AV:N/AC:L/PR:N/UI:N) against default configurations of Apache OFBiz 24.09 through 24.09.07, by appending a protected view name as a path suffix to any public control request (the advisory cites /catalog/control/ListLocales/showPortalPage). The limiting factors are: the installation must be a vulnerable 24.09 branch below 24.09.08, the attacker needs HTTP reachability to the OFBiz control servlet, and the impact is confined to rendering/reading protected views (confidentiality only) rather than performing authenticated actions; upgrading to 24.09.08 is the vendor-stated fix. |
| Impact | Multiple signals converge on a moderate, read-only confidentiality risk. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) confirms remote, unauthenticated, low-complexity exploitation with no user interaction, and the description corroborates this: an attacker simply appends a protected view to a public request path. However, impact is bounded - C:H but I:N/A:N - so this is unauthorized information disclosure via authorization bypass (CWE-288), not code execution or data tampering. Tempering the urgency, EPSS is low at 0.30% (23rd percentile), the CVE is NOT in CISA KEV, and no public exploit is identified in the provided data. The vuln.today decision label is 'this_week', consistent with a patchable, network-reachable disclosure bug that is not under active exploitation. Net: a genuine priority to patch on a normal cycle, but not an emergency - the headline 7.5 reflects easy reachability and high confidentiality loss, while the real-world exploitation likelihood remains low per EPSS and the absence of KEV/POC. Note the low EPSS is consistent with no observed exploitation rather than conflicting with any high-exploitation signal. |
| Exploit ScenarioDerived | A remote, unauthenticated attacker crafts a URL that targets a public OFBiz request but appends a protected view as a path suffix (e.g., /catalog/control/ListLocales/showPortalPage), causing the RequestHandler to authorize on the public path component while rendering the protected view. The attacker thereby reads content that should require authentication. No public exploit code is identified at time of analysis, though the example path in the advisory makes the technique straightforward to reproduce. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Nov 10, 2026
Remote unauthenticated attackers can read protected views in Apache OFBiz 24.09 through 24.09.07 by appending a protected view name as a path suffix to a public control request (for example /catalog/control/ListLocales/showPortalPage), because RequestHandler authorizes only the public path component while still rendering the protected suffix view. The flaw is rated CVSS 7.5 (CWE-288, incorrect authorization) with impact limited to confidentiality - protected views can be disclosed, but the bypass does not grant authenticated actions. EPSS is low at 0.30% (23rd percentile), no CISA KEV entry or confirmed public exploit is available, and the vendor-released fix is Apache OFBiz 24.09.08.
Earlier versions of this analysis (1)
An unauthenticated authorization bypass in Apache OFBiz's view-handling layer allows remote attackers to reach views that should be gated behind access controls by supplying a crafted path suffix that falls outside the check applied to the intended view. Every OFBiz release prior to 24.09.08 is affected; the vendor's advisory bundles this CVE with roughly 45 other flaws - including several pre-authentication RCE issues - all fixed in 24.09.08. The independent assessment scores it CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N (high confidentiality impact only, no integrity or availability impact), and no CVSS, CWE, or EPSS data was published by the vendor; the CVE is not on CISA KEV and no public exploit has been identified at time of analysis, with the priority decision still marked 'awaiting_data'.
RemediationAI
Upgrade to Apache OFBiz 24.09.08, the version the vendor states fixes this issue, following the download and upgrade guidance at https://ofbiz.apache.org/ and the announcement at https://seclists.org/oss-sec/2026/q4/516; the vendor recommends upgrading as the remediation. Patch availability is confirmed by the vendor, and the priority label for this issue is this_week, driven by the network-reachable unauthenticated bypass rather than by observed exploitation (EPSS 0.30%, no KEV listing, no confirmed public exploit). Where upgrading cannot be completed immediately, exposure should be reduced by limiting network access to the OFBiz control servlet, particularly the public /catalog/control endpoints cited in the advisory, since the vulnerability is exploitable over HTTP reachability with no credentials; note that this constrains legitimate storefront/public traffic and is a stopgap, not a substitute for the 24.09.08 upgrade. Operators should also review web and application logs for requests that append view names such as showPortalPage to public control paths, since such requests are the documented bypass pattern.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Apache OFBiz is a Java-based open-source ERP/e-commerce framework whose ControlServlet routes requests through RequestHandler for authorization before dispatching to view handlers. CWE-288 (authentication bypass using an alternate path or channel) is the root-cause class: the handler resolves and checks the leading, public portion of the request path, but the view resolution logic subsequently honors an appended path segment naming a protected view. This path-parsing/authorization mismatch means the access-control decision and the rendered resource are derived from different parts of the same URI, so any public control endpoint on a vulnerable 24.09 branch becomes a pivot to protected views. Per the assessed vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), no credentials, user interaction, or special conditions beyond HTTP reachability to the control servlet are required on default configurations, and the impact is confined to reading/rendering protected views rather than state change.
Know when Apache Ofbiz gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Remote unauthenticated bypass with no user interaction (AV:N/AC:L/PR:N/UI:N); impact is disclosure of a protected view only, so C:H with I:N/A:N and no scope change.
Primary rating from Vendor (CNA).
CVSS VectorVendor
Lifecycle Timeline
4Description PRE-NVD
Articles & Coverage 1
Executive ViewAI
Apache OFBiz versions 24.09 through 24.09.07 contain an authorization bypass that lets unauthenticated outsiders view protected screens, potentially exposing internal business data. Leadership should care because this could leak sensitive operational details without any login, eroding customer and partner trust, though the flaw does not allow changes or authenticated actions.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Apache Ofbiz
View allRemote code execution in Apache OFBiz before 24.09.06 stems from an improper authentication flaw in the password-change
Remote unauthenticated code execution in Apache OFBiz 24.09 before 24.09.08 allows an attacker to execute arbitrary comm
Unauthenticated resource exhaustion affects Apache OFBiz installations running in multitenant mode, where a remote clien
LDAP injection in Apache OFBiz before 24.09.06 allows remote unauthenticated attackers to inject special characters into
Sensitive data exposure and integrity compromise in Apache OFBiz before 24.09.06 stems from a hard-coded cryptographic k
Authenticated code injection in Apache OFBiz versions prior to 24.09.06 allows remote attackers with low-privileged acco
Authenticated command execution in Apache OFBiz 24.09 (before 24.09.08) lets a low-privileged user escalate from view-on
Authenticated OS command execution in Apache OFBiz 24.09 before 24.09.08 lets a low-privileged accounting user run arbit
Authenticated code injection in the Apache OFBiz cms plugin allows a CMS content-editor to run arbitrary operating syste
Authenticated users who hold access to the Sales Force Automation (SFA) component in Apache OFBiz before 24.09.08 can su
Improper authorization in the OFBiz ContentWorker lets a remote unauthenticated attacker invoke an arbitrary OFBiz servi
Unauthenticated remote attackers can bypass the request-map authentication policy in Apache OFBiz 24.09 (before 24.09.08
Exploit-DB