Apache OFBiz versions prior to 24.09.08 contain a vulnerability in the REST API framework's ModelApiReader parser. Due to an incorrect default value for the auth attribute in .rest.xml definitions, unauthenticated remote attackers can invoke REST API operations without valid credentials. This occurs because ModelApiReader incorrectly treats the missing auth attribute as false, allowing unauthorized access. The issue is fixed in version 24.09.08.
Apache OFBiz versions prior to 24.09.08 contain a hard-coded password vulnerability in the AdminServer component. This flaw allows an attacker who can access the AdminServer control port to query the server's running state and perform an unauthenticated shutdown of the instance using the fixed default control key. The issue is resolved in version 24.09.08.
A vulnerability has been found in agentscope-ai AgentScope up to 2.0.11. This impacts the function get_current_user_id of the file src/agentscope/app/deps.py of the component Agent Service. Such manipulation of the argument X-User-ID leads to missing authentication. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. The pull request to fix this issue awaits acceptance.
CVE-2026-97356 is a vulnerability in Apache OFBiz 24.09.07 and earlier that allows an authenticated user with LABEL_MANAGER_VIEW permission to read arbitrary properties and XML files on the server via the fileName parameter in the ViewFile component. This includes access to the JWT signing key, enabling forgery of administrator sessions. The issue is fixed in version 24.09.08.
Apache OFBiz versions prior to 24.09.08 contain a forced browsing vulnerability in the Content Manager component. Authenticated users with only view permissions can re-parent content associations they do not own by sending a direct POST request to the moveContentJson endpoint, which lacks proper permission checks. This issue is fixed in version 24.09.08.
Apache OFBiz versions prior to 24.09.08 contain an improper input validation vulnerability in the Order Returns functionality. This flaw allows an authenticated user without the ORDERMGR_CREATE permission to set an arbitrary price on a return item via the createReturnItem service, bypassing the intended server-enforced price ceiling. The issue is fixed in version 24.09.08.
A vulnerability in Apache OFBiz prior to version 24.09.08 allows users with only ACCOUNTING_VIEW permission to update or create PaymentApplication records due to missing permission checks. This issue is classified as CWE-425 (Forced Browsing).
Apache OFBiz versions 24.09.06 and 24.09.07 contain a hard-coded cryptographic key vulnerability in JWT token authentication. This flaw allows an unauthenticated attacker with network access to gain full administrative privileges by forging a JWT signed with the default security.token.key. The issue affects deployments upgraded from versions before CVE-2026-31986 that retained their original security.properties with security.internal.sso.enabled set to true. The vulnerability is fixed in version 24.09.08. Users must upgrade and run './gradlew rotateSecretKeys' to replace any existing hard-coded keys.
A vulnerability in Apache OFBiz prior to version 24.09.08 allows users with only ORDERMGR_VIEW permission to update orders due to a missing permission check (CWE-425 Forced Browsing). The issue is fixed in version 24.09.08.
Apache OFBiz versions prior to 24.09.08 contain an authorization bypass vulnerability in the Order Manager component. Authenticated users with only view-level order permissions can modify or create OrderPaymentPreference records for orders outside their authorized scope by supplying an orderPaymentPreferenceId of a different order. This issue is fixed in version 24.09.08.
CVE-2026-109837 is an authorization bypass vulnerability in Apache OFBiz versions prior to 24.09.08. It allows an authenticated user with low-privileged Order Manager access to associate another party's OrderItem with a ReturnItem on a ReturnHeader they control via the createReturnItem service. The issue is fixed in version 24.09.08.
Apache OFBiz versions before 24.09.08 contain a forced browsing vulnerability that allows authenticated users with low privileges to perform unauthorized financial account operations. These operations include creating, modifying, and canceling financial account transactions and balances via direct service requests. The issue is fixed in version 24.09.08.
Apache OFBiz versions before 24.09.08 contain an authentication flaw in the password-reset and login JWT validation process. An attacker who obtains a user's password-reset token through interception or exposure can bypass the intended password-change flow and authenticate directly as that user, potentially gaining full session access including administrative privileges. This issue is fixed in version 24.09.08.
A cross-site scripting (XSS) vulnerability exists in the Catalog image viewer component of Apache OFBiz versions before 24.09.08. This flaw allows an unauthenticated attacker to execute arbitrary JavaScript in the browser session of a logged-in back-office user by crafting a malicious viewImage URL that the user opens within the application. The issue is fixed in version 24.09.08.
Apache OFBiz versions before 24.09.08 contain an incorrect privilege assignment vulnerability in the Order Manager. Authenticated users with only order view permissions (ORDERMGR_VIEW) can modify approved orders, including changing shipping addresses, shipment methods, or appending items with overridden prices. This issue is fixed in version 24.09.08.
CVE-2026-114235 is a forced browsing vulnerability in Apache OFBiz 24.09 versions prior to 24.09.08. It allows an authenticated user with only view access to the Order Manager component to modify shipment tracking numbers of any order by directly accessing the updateTrackingNumber endpoint. The issue is fixed in version 24.09.08.
Apache OFBiz versions prior to 24.09.08 contain an authorization bypass vulnerability in the shopping list services. This flaw allows an authenticated low-privileged user to modify or take ownership of another user's shopping list by supplying the other party's shopping list ID in a request. The issue is fixed in version 24.09.08.
Apache OFBiz versions before 24.09.08 contain an authorization bypass vulnerability in the content viewing component. Authenticated users with role-scoped content view permission can read data of content they are not authorized to access by crafting a ViewSimpleContent request combining a contentId they can view with the dataResourceId of other content. This issue is fixed in version 24.09.08.
Apache OFBiz versions before 24.09.08 contain an authentication bypass vulnerability in the optional Janrain Engage Social Login integration. This flaw allows improper binding of authenticated external identities to local user accounts, potentially enabling unauthorized access. The issue is fixed in version 24.09.08.
A flaw has been found in agentscope-ai AgentScope up to 2.0.8. This affects the function check_permissions of the file src/agentscope/tool/_builtin/_bash.py of the component Bash Tool. This manipulation causes incorrect authorization. Remote exploitation of the attack is possible. The exploit has been published and may be used. Upgrading to version 2.0.9 mitigates this issue. Patch name: 6b43b13a46401e86abd3defeed9a8bfe5b37bc6d. It is recommended to upgrade the affected component.