Apache OFBiz EUVD-2026-30874

No authentication is required - the CVSS vector PR:N/AV:N/AC:L confirms the Webtools endpoint is reachable by any unauthenticated network client without elevated privileges or special configuration. The primary prerequisite is network reachability to the OFBiz HTTP/HTTPS service; internet-facing deployments face the broadest exposure. Exploitation is bounded by the partial impact scope (C:L/I:L/A:N) - an attacker cannot achieve full system compromise or cause service disruption through this flaw alone. No specific non-default configuration is identified as a prerequisite; all OFBiz deployments running a version before 24.09.06 with Webtools present are affected.

The CVSS 6.5 Medium score is driven by a fully network-accessible, low-complexity, unauthenticated attack path (AV:N/AC:L/PR:N/UI:N), which objectively represents a meaningful exposure level. However, real-world urgency is moderated by several converging signals: EPSS sits at 0.02% (4th percentile), indicating that across all observed exploitation telemetry, weaponization has not materialized; CISA KEV lists no active exploitation; and SSVC records Exploitation=none. The one concerning SSVC signal is Automatable=yes - an attacker can script the bypass without manual interaction, meaning if a working technique is published, mass exploitation becomes straightforward. Technical Impact is assessed as partial (C:L/I:L/A:N), limiting blast radius to read/write of restricted data rather than full system compromise. Overall: low immediate exploitation pressure but elevated automation risk once exploited - prioritize patching in internet-facing deployments over internal-only instances.

An unauthenticated attacker with network access to an OFBiz instance sends crafted HTTP requests directly to Webtools endpoints, bypassing the application's authorization checks. Because the attack is automatable (SSVC: Automatable=yes), a scanner or script could enumerate exposed OFBiz instances and attempt the bypass at scale. Successful exploitation yields partial read and write access to data or functions gated behind Webtools authorization.