EUVD-2026-36169
GHSA-7c94-45hg-hmp3
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network-reachable web app (AV:N), no special conditions (AC:L), requires a low-privileged authenticated account (PR:L), no user interaction (UI:N), and full admin takeover yields C:H/I:H/A:H within the same OFBiz scope.
Primary rating from NVD.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
6Description PRE-NVD
Articles & Coverage 2
AnalysisAI
Privilege escalation in Apache OFBiz versions prior to 24.09.07 allows a low-privileged authenticated user to elevate their permissions to a higher-privileged role, leading to full compromise of confidentiality, integrity, and availability of the ERP system. The flaw is rooted in improper authorization (CWE-285) and is exploitable remotely over the network with low complexity once valid low-tier credentials are held. No public exploit identified at time of analysis, and EPSS scoring (0.02%) plus CISA SSVC (Exploitation: none) suggest no observed exploitation activity yet.
Technical ContextAI
Apache OFBiz is an open-source enterprise resource planning (ERP) suite providing accounting, CRM, e-commerce, manufacturing, and supply chain modules built on a Java/Groovy stack with a permission-based security model centered on user logins, security groups, and permission services. The root cause is CWE-285 (Improper Authorization), meaning an authorization check is missing, incorrectly applied, or bypassable on a sensitive code path - allowing a session holding low-privilege permissions to invoke or reach functionality that the OFBiz permission service should have restricted to administrative or higher-tier users. Because OFBiz exposes a wide range of web-facing controllers and service endpoints, an authorization gap of this class typically lets an attacker pivot from an end-user account to administrative service execution within the same application context.
RemediationAI
Vendor-released patch: upgrade Apache OFBiz to version 24.09.07 or later, which the project explicitly identifies as the fixed release; this is the primary and recommended remediation per the Apache advisory at https://ofbiz.apache.org/ and the disclosure at https://seclists.org/oss-sec/2026/q2/873. If immediate upgrade is not possible, compensating controls include restricting OFBiz web access (typically ports 443/8443 and 80/8080) to trusted networks or VPN users via firewall or reverse-proxy ACLs to reduce the pool of potential low-privilege attackers, disabling any self-registration or anonymous account creation flows in the OFBiz user-management configuration to prevent attackers from trivially obtaining the required low-privilege foothold (side effect: blocks legitimate customer/partner self-onboarding), and tightening permission-group assignments so that low-tier users carry only the minimum security groups required, with audit-log monitoring on PartyManager, WebTools, and admin service invocations to detect anomalous escalation attempts. None of these workarounds eliminate the underlying authorization flaw, so they should be treated as bridging measures until 24.09.07 is deployed.
Incorrect Authorization vulnerability in Apache OFBiz.12.14. Rated critical severity (CVSS 9.8), this vulnerability is r
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache OFBiz.12.13. Rate
The vulnerability permits attackers to circumvent authentication processes, enabling them to remotely execute arbitrary
Pre-auth RCE in Apache Ofbiz 18.12.09. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, n
Apache OFBiz has unsafe deserialization prior to 17.12.06. Rated critical severity (CVSS 9.8), this vulnerability is rem
Server-Side Request Forgery (SSRF), Improper Control of Generation of Code ('Code Injection') vulnerability in Apache OF
Apache OFBiz has unsafe deserialization prior to 17.12.07 version. Rated critical severity (CVSS 9.8), this vulnerabilit
Apache OFBiz has unsafe deserialization prior to 17.12.07 version An unauthenticated user can perform an RCE attack. Rat
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache OFBiz.12.14. Rate
XML-RPC request are vulnerable to unsafe deserialization and Cross-Site Scripting issues in Apache OFBiz 17.12.03. Rated
Apache OFBiz 12.04.x before 12.04.06 and 13.07.x before 13.07.03 allow remote attackers to execute arbitrary commands vi
Direct Request ('Forced Browsing') vulnerability in Apache OFBiz.12.16. Rated high severity (CVSS 7.5), this vulnerabili
Same weakness CWE-285 – Improper Authorization
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today