Apache OFBiz EUVD-2026-30869

The CVSS vector PR:N/AV:N/AC:L/UI:N indicates no special conditions are required - exploitation is feasible against any network-accessible Apache OFBiz instance running a version prior to 24.09.06 without authentication or user interaction. The specific endpoint or feature containing the authentication bypass is not identified in the available advisory text, which limits precise pre-screening. Limiting factors include: impact is confined to partial confidentiality (C:L) with no integrity or availability consequence per CVSS, meaning attackers cannot modify data or disrupt availability through this vector alone; the application must be reachable over the network (internet-exposed or accessible from an attacker-controlled network segment); and no exploitation tooling has been publicly released, keeping realistic threat levels low at time of analysis.

The CVSS 3.1 score of 5.3 (Medium) with vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N quantifies the impact as limited to confidentiality (C:L) with no integrity or availability consequence - a constrained but real information-disclosure risk. EPSS at 0.02% (6th percentile) indicates very low current exploitation probability in the wild, suggesting the vulnerability has not attracted broad attacker tooling. No CISA KEV listing is present, and no public proof-of-concept has been identified. The SSVC assessment introduces a notable nuance: the attack is flagged as automatable despite its low EPSS, meaning automated scanners could probe at scale, and the partial technical impact aligns with CVSS C:L. The overall picture is a moderate-priority vulnerability - real and remotely exploitable without authentication, but constrained impact and no confirmed exploitation lower the urgency relative to integrity- or RCE-class flaws. Organizations running internet-exposed OFBiz instances should treat this as a timely patch rather than an emergency response.

An unauthenticated remote attacker targets an internet-facing Apache OFBiz deployment running any version before 24.09.06, sending a specially crafted HTTP request that bypasses the application's authentication enforcement on a vulnerable endpoint. The attacker obtains read access to information that would normally require valid credentials, such as partial application data or configuration details. No public proof-of-concept has been identified at time of analysis, though SSVC confirms the attack path is automatable, making mass-scanning a realistic delivery mechanism.