CVE-2026-71901 is a Resource Injection vulnerability in Apache OFBiz that allows an authenticated user with access to the sfa component to override the service used during vcard import and potentially access other services. This issue affects versions before 24.09.08. The vulnerability is fixed in version 24.09.08.
Apache OFBiz before version 24.09.08 contains a code injection vulnerability (CWE-94) that allows an unauthenticated attacker to exploit temporary-file handling and inject a malicious file URI. This causes OFBiz to load an attacker-controlled Screen definition, potentially leading to arbitrary code execution or unauthorized actions. The issue is fixed in version 24.09.08.
Apache OFBiz versions prior to 24.09.08 contain an authentication bypass vulnerability in the RequestHandler component. This flaw allows a remote unauthenticated attacker to access protected views by appending the protected path as a suffix to a public request path, causing improper authorization. The issue is fixed in version 24.09.08.
Apache OFBiz versions before 24.09.08 contain an authentication bypass vulnerability in the RequestHandler.renderView function. This flaw allows remote unauthenticated attackers to bypass request-map authentication by manipulating the _LAST_VIEW_NAME_ value stored in the anonymous session. As a result, protected views and associated business data may be exposed without proper authorization. The issue is fixed in version 24.09.08.
CVE-2026-73580 is a missing authorization vulnerability in Apache OFBiz up to version 24.09.07. It allows a remote unauthenticated attacker to recursively enumerate sensitive Human Resources data, including department and employee identifiers, position names, and organizational relationships. The issue is fixed in version 24.09.08.
CVE-2026-74841 is an uncontrolled resource consumption vulnerability in Apache OFBiz affecting versions prior to 24.09.08. In multitenant deployments, the application builds a per-tenant delegator name from a user-supplied tenant ID before verifying tenant existence. The internal cache retains all delegator names requested, including invalid ones, allowing an unauthenticated attacker to submit arbitrary tenant IDs and cause unbounded cache growth, leading to increased memory and database load.
A path traversal vulnerability exists in Apache OFBiz through version 24.09.07, allowing a remote authenticated attacker with Catalog view permission to overwrite arbitrary files writable by the OFBiz process. This occurs due to missing authorization checks in the replaceImageToExistImage service and can be exploited via crafted parameters. The issue is fixed in version 24.09.08.
Apache OFBiz versions before 24.09.08 contain a missing authorization vulnerability in ProductEvents. This flaw allows a remote authenticated user with only catalog view permission to create, modify, or delete product-related data by invoking certain catalog quick-admin events. The issue arises because the servlet authorizes requests against a base view-level permission, while the underlying event methods perform write operations without verifying the required update/create permissions. Upgrading to version 24.09.08 resolves this vulnerability.
CVE-2026-76152 is a path traversal vulnerability in Apache OFBiz up to version 24.09.07. It allows a remote authenticated attacker with Catalog view permission to read arbitrary image-parsable files accessible by the OFBiz process and write re-encoded images to arbitrary writable directories. The issue is fixed in version 24.09.08.
Apache OFBiz versions before 24.09.08 contain an authorization vulnerability in ContentPermissionServices. A remote authenticated attacker with limited content-create permission can exploit this flaw to self-assign the OWNER role on arbitrary content. This occurs because the permission check incorrectly defaults to granting access when no matching ContentPurposeOperation entry is found. The OWNER role enables full control over the content, including update, removal, and status changes. The issue is fixed in version 24.09.08.
Apache OFBiz versions before 24.09.08 contain a missing authorization vulnerability in ProductSearchEvents. A remote authenticated user with only catalog view permission can bulk-modify product category and feature associations across arbitrary search results. This occurs because the servlet authorizes requests only against the base view-level permission, while underlying event methods perform bulk deletes and inserts without enforcing proper DELETE/CREATE permissions. The issue is fixed in version 24.09.08.
A SQL Injection vulnerability exists in Apache OFBiz versions before 24.09.08 on MySQL/MariaDB-backed deployments. The flaw occurs in the entity engine's generic performFind service when handling ignore-case find requests with crafted values, allowing remote unauthenticated attackers to disclose arbitrary database rows. The issue arises because the input is inlined into SQL text with insufficient escaping for MySQL/MariaDB, enabling payloads to break out of string literals. This vulnerability does not affect Derby or PostgreSQL datasources. Upgrading to version 24.09.08 resolves the issue.
An XML External Entity (XXE) injection vulnerability exists in Apache OFBiz versions before 24.09.08. A remote authenticated attacker with content-author permissions can exploit this flaw by storing crafted XML content that includes an external entity declaration. This causes the ContentWorker component to parse the XML insecurely, allowing the attacker to read arbitrary server files and trigger server-side request forgery. The issue is fixed in version 24.09.08.
CVE-2026-81828 is a Server-Side Request Forgery (SSRF) vulnerability in Apache OFBiz versions before 24.09.08. It allows an authenticated back-office user with catalog permission to specify arbitrary URLs as a product-store survey's template location. This causes the server to fetch and render attacker-controlled content, including internal network resources and local files, without validating the URL scheme or host. The malicious content is then rendered into the HTTP response for any shopper loading the affected survey, resulting in non-blind information disclosure. The issue is fixed in version 24.09.08.
Apache OFBiz versions before 24.09.08 contain an improper authorization vulnerability in the ContentWorker component. This flaw allows remote unauthenticated attackers to invoke arbitrary OFBiz services with attacker-controlled parameters, leading to arbitrary file write, file deletion, and server-side request forgery. The issue arises because the serviceName field in a Content row can be set by accounts with limited permissions, and the vulnerable code does not verify ownership or authentication before invoking the service. Upgrading to version 24.09.08 resolves this vulnerability.
Server-Side Request Forgery in ViewDataFile in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote authenticated attacker holding only the base webtools permissions (OFBTOOLS_VIEW, WEBTOOLS_VIEW) to cause the server to issue arbitrary outbound HTTP requests, and an attacker additionally holding ENTITY_MAINT and DATAFILE_MAINT to read arbitrary local files via a file: URL, by supplying the DEFINITION_LOCATION or DATAFILE_LOCATION request parameter to the viewdatafile screen, because ViewDataFile.groovy dereferences both parameters as java.net.URL objects with no scheme allow-list, host filter, or egress control inside a screen action that runs before the screen's and template's permission checks are evaluated, so the fetch executes regardless of whether the requesting account is authorized to view its result. Users are recommended to upgrade to version 24.09.08, which fixes this issue.
Uncontrolled Resource Consumption in ServiceMultiEventHandler in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote unauthenticated attacker to pin a server request thread for an attacker-chosen number of synchronous service dispatches, up to the signed-integer maximum, by submitting a single small HTTP request whose parameter names encode a row count via the "o" suffix used by multi-form submissions, because UtilHttp.getMultiFormRowCount derives that count from the largest such suffix with no upper bound and ServiceMultiEventHandler.invoke then loops that many times calling dispatcher.runSync, with the request-map for getFinAccountTransRunningTotalAndBalances reaching this handler with no authentication or CSRF requirement on a stock deployment. Users are recommended to upgrade to version 24.09.08, which fixes this issue.
Apache OFBiz versions before 24.09.08 are vulnerable to an authentication bypass via capture-replay of externalLoginKey values. An attacker who captures a live externalLoginKey can reuse it to gain a full session as the user without needing cookies, across all web applications accessible to that user. This occurs because the externalLoginKey is accepted as a bearer token globally before CSRF and authentication checks, is never bound to a client, does not expire, and is not invalidated after use. The framework appends live keys to cross-webapp links, and an authenticated user's key can be leaked to an attacker-controlled server via unvalidated inter-app link targets. Upgrading to version 24.09.08 addresses this issue.
CVE-2026-82910 is a server-side template injection vulnerability in Apache OFBiz MacroScreenRenderer versions before 24.09.08. It allows a remote authenticated attacker with minimal view permissions to execute arbitrary OS commands as the OFBiz service account via crafted GET requests exploiting improper neutralization of template elements. The issue is fixed in version 24.09.08.
Improper Neutralization of Special Elements Used in an Expression Language Statement ('Expression Language Injection') in EmailServices in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote authenticated attacker holding only OFBTOOLS_VIEW and ACCOUNTING_VIEW, the two view-level permissions that open the Accounting application, to execute arbitrary operating system commands as the account running OFBiz, by submitting a ${groovy:...} expression as the bodyText or subject value to the shipped Send Per Email invoice form, because sendMailFromScreen passes those caller-supplied values through FlexibleStringExpander.expandString, which compiles and evaluates embedded Groovy on a class loader that carries none of the SecureASTCustomizer restrictions GroovyUtil.eval applies elsewhere, behind a service and request-map that declare no permission check beyond base authentication. Users are recommended to upgrade to version 24.09.08, which fixes this issue.