Authentication Bypass by Capture-replay in ExternalLoginKeysManager in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote unauthenticated attacker who captures a live externalLoginKey value to obtain a complete, cookie-free, reusable session as the user who issued it, in every webapp that user can reach, because checkExternalLoginKey runs as a global preprocessor ahead of both the CSRF and authentication checks and accepts the key as a bearer credential that is never bound to a client, never expires, and is not invalidated after use, while the framework itself both appends live keys to every cross-webapp link it renders and, via WidgetWorker's unvalidated inter-app link target, lets an authenticated user's key be attached to an attacker-chosen absolute URL and delivered directly to the attacker's own server. Users are recommended to upgrade to version 24.09.08, which fixes this issue.
Improper Neutralization of Special Elements Used in a Template Engine ('Server-Side Template Injection') in MacroScreenRenderer in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote authenticated attacker holding only the two view permissions of a control-servlet webapp (e.g. CATALOG_VIEW and OFBTOOLS_VIEW on /catalog, held by OFBiz's own shipped order-entry clerk role) to execute arbitrary operating system commands as the OFBiz service account with a single GET request, by placing an apostrophe followed by FreeMarker expression source in a screen link parameter value, because renderLink concatenates link parameter values verbatim between apostrophes into an unquoted, unescaped template-source string that is compiled and evaluated at render time, allowing the injected expression to reach the allow-listed FlexibleStringExpander.expandString call and, through a runtime-assembled Groovy interpolation, unsandboxed code execution. Users are recommended to upgrade to version 24.09.08, which fixes this issue.
Improper Neutralization of Special Elements Used in an Expression Language Statement ('Expression Language Injection') in EmailServices in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote authenticated attacker holding only OFBTOOLS_VIEW and ACCOUNTING_VIEW, the two view-level permissions that open the Accounting application, to execute arbitrary operating system commands as the account running OFBiz, by submitting a ${groovy:...} expression as the bodyText or subject value to the shipped Send Per Email invoice form, because sendMailFromScreen passes those caller-supplied values through FlexibleStringExpander.expandString, which compiles and evaluates embedded Groovy on a class loader that carries none of the SecureASTCustomizer restrictions GroovyUtil.eval applies elsewhere, behind a service and request-map that declare no permission check beyond base authentication. Users are recommended to upgrade to version 24.09.08, which fixes this issue.
Missing Authorization in XmlDsDump in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote authenticated attacker holding only the webtools base permissions (OFBTOOLS_VIEW, WEBTOOLS_VIEW) — explicitly not the ENTITY_MAINT permission the export feature declares and visibly refuses to render for — to export the contents of any database entity, including UserLogin with its currentPassword hashes, to any filesystem path the OFBiz process can write, including a web-served docroot, and to create arbitrary directories or truncate arbitrary existing files at those paths, because the XmlDsDump screen action writes the requested entity data via new FileOutputStream on unvalidated outpath and filename request parameters before the screen's ENTITY_MAINT permission check runs, unlike the equivalent Java service entityExportAll, which enforces both a permission check and a file-path allow-list. Users are recommended to upgrade to version 24.09.08, which fixes this issue.
Improper Control of Generation of Code ('Code Injection') in ModelFormField in the Apache OFBiz cms plugin before 24.09.08 on all platforms allows a remote authenticated attacker holding only CMS content-editor access to execute arbitrary operating system commands as the OFBiz process user via a single HTTP POST request, by submitting a crafted caContentIdTo parameter to EditAddContent, because the CMS screen copies that parameter into a top-level context variable that is interpolated into a form field's use-when attribute and the resulting string is passed unvalidated to GroovyUtil.eval(), whose compile-time SecureASTCustomizer sandbox does not restrict runtime reflection, allowing a payload that closes the expanded string literal and invokes java.lang.Runtime via reflection. Users are recommended to upgrade to version 24.09.08, which fixes this issue.
Missing Authorization in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote unauthenticated attacker to disclose internal business records — including organization, employee, product catalog, and product-store data — by requesting several helper endpoints across the Human Resources, Catalog, and Order Manager applications that are configured to skip authentication and perform no permission check before returning the requested record. Users are recommended to upgrade to version 24.09.08, which fixes this issue.
A vulnerability was identified in itsourcecode Online Book Store 1.0. Affected by this issue is some unknown functionality of the file /admin_edit.php. The manipulation of the argument bookisbn leads to sql injection. It is possible to initiate the attack remotely. The exploit is publicly available and might be used.
A vulnerability in ChatGPT's Lockdown Mode allows attackers to bypass its protections and perform silent exfiltration of chat data, phishing, and malware delivery. The flaw exploits the HTML page preview feature in ChatGPT code blocks, enabling attackers to open pop-up windows outside the sandbox, exfiltrate entire chat histories without user interaction, and display phishing content. This bypass undermines Lockdown Mode's restrictions on outbound network requests and content loading. The attack surface includes data theft, social engineering via interface manipulation, and malware distribution within the trusted ChatGPT interface.
Improper Control of Generation of Code ('Code Injection') in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote unauthenticated attacker to execute arbitrary code on the server by staging crafted widget XML in a multipart upload and overriding the mainDecoratorLocation used by a manager login route through an anonymous JSON request, causing OFBiz to load the staged XML through its live screen descriptor mechanism and evaluate an unsandboxed Groovy expression while rendering the authentication-failure page. Further validation established the following:
-- The exploit does not require a malformed or incomplete multipart body: a well-formed multipart request that is kept in flight and then allowed to complete normally is sufficient.
-- The screen loader reads the widget XML from a live process file descriptor while the upload is streaming, rather than from any file the attacker persists to disk.
-- The same underlying issue is also reachable through the public, explicitly unauthenticated /sfa/control/editPortalPageColumnWidth route, returning command output directly in an HTTP 200 response — it is not limited to the login-failure rendering path used in the original report.
Users are recommended to upgrade to version 24.09.08, which fixes this issue.
Incorrect Authorization in the updateLayout simple-method in applications/content/minilang/layout/LayoutEvents.xml in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote authenticated attacker holding only OFBTOOLS_VIEW and CONTENTMGR_VIEW to execute arbitrary commands as the OFBiz process user, by using updateLayout's authorization check — which validates only the fixed CONTENT_CREATE operation rather than an update permission on the actual Content record and an independently selected DataResource — to relink an existing RESPONSE-purpose Content record and convert an arbitrary, independently selected DataResource into an OFBIZ_FILE/FTL resource pointed at the OFBiz access log, poisoned via a crafted User-Agent header and evaluated through the normal authenticated showContent route. Users are recommended to upgrade to version 24.09.08, which fixes this issue.
CVE-2026-84728 is an incorrect authorization vulnerability in Apache OFBiz versions before 24.09.08 when multitenancy is enabled. It allows a remote authenticated attacker with a low-privilege account in one tenant to read and write data belonging to another tenant by exploiting tenant identification conflicts during login. The issue is fixed in version 24.09.08.
CVE-2026-85627 is a server-side template injection vulnerability in Apache OFBiz versions before 24.09.08. It allows a remote authenticated user with a non-administrative account to execute arbitrary OS commands as the OFBiz process user by exploiting improper neutralization of special elements in the template engine. The issue is fixed in version 24.09.08.
CVE-2026-76563 is a cross-site scripting (XSS) vulnerability in Fileorbis Informatics Services Trade Inc.'s Fileorbis product. The flaw involves improper neutralization of script-related HTML tags, allowing malicious files to execute scripts in a web page context. This vulnerability affects all versions prior to 12.5.4. It has a CVSS 3.1 base score of 6.1, indicating a medium severity level. No known exploits are reported in the wild. The issue is fixed in version 12.5.4.
Apache OFBiz versions prior to 24.09.08 contain a vulnerability in the REST API framework's ModelApiReader parser. Due to an incorrect default value for the auth attribute in .rest.xml definitions, unauthenticated remote attackers can invoke REST API operations without valid credentials. This occurs because ModelApiReader incorrectly treats the missing auth attribute as false, allowing unauthorized access. The issue is fixed in version 24.09.08.
Apache OFBiz versions prior to 24.09.08 contain a hard-coded password vulnerability in the AdminServer component. This flaw allows an attacker who can access the AdminServer control port to query the server's running state and perform an unauthenticated shutdown of the instance using the fixed default control key. The issue is resolved in version 24.09.08.
CVE-2026-123024 is a medium-severity vulnerability in agentscope-ai AgentScope versions 2.0.0 through 2.0.11. It affects the get_current_user_id function in the Agent Service component, where manipulation of the X-User-ID argument leads to missing authentication. This flaw allows remote attackers to bypass authentication controls. A fix has been proposed but is not yet accepted or available.
CVE-2026-97356 is a vulnerability in Apache OFBiz 24.09.07 and earlier that allows an authenticated user with LABEL_MANAGER_VIEW permission to read arbitrary properties and XML files on the server via the fileName parameter in the ViewFile component. This includes access to the JWT signing key, enabling forgery of administrator sessions. The issue is fixed in version 24.09.08.
Apache OFBiz versions prior to 24.09.08 contain a forced browsing vulnerability in the Content Manager component. Authenticated users with only view permissions can re-parent content associations they do not own by sending a direct POST request to the moveContentJson endpoint, which lacks proper permission checks. This issue is fixed in version 24.09.08.
Apache OFBiz versions prior to 24.09.08 contain an improper input validation vulnerability in the Order Returns functionality. This flaw allows an authenticated user without the ORDERMGR_CREATE permission to set an arbitrary price on a return item via the createReturnItem service, bypassing the intended server-enforced price ceiling. The issue is fixed in version 24.09.08.
A vulnerability in Apache OFBiz prior to version 24.09.08 allows users with only ACCOUNTING_VIEW permission to update or create PaymentApplication records due to missing permission checks. This issue is classified as CWE-425 (Forced Browsing).