Apache OFBiz versions prior to 24.09.08 contain an authentication bypass vulnerability in the RequestHandler component. This flaw allows a remote unauthenticated attacker to access protected views by appending the protected path as a suffix to a public request path, causing improper authorization. The issue is fixed in version 24.09.08.
Apache OFBiz versions before 24.09.08 contain an authentication bypass vulnerability in the RequestHandler.renderView function. This flaw allows remote unauthenticated attackers to bypass request-map authentication by manipulating the _LAST_VIEW_NAME_ value stored in the anonymous session. As a result, protected views and associated business data may be exposed without proper authorization. The issue is fixed in version 24.09.08.
CVE-2026-73580 is a missing authorization vulnerability in Apache OFBiz up to version 24.09.07. It allows a remote unauthenticated attacker to recursively enumerate sensitive Human Resources data, including department and employee identifiers, position names, and organizational relationships. The issue is fixed in version 24.09.08.
CVE-2026-74841 is an uncontrolled resource consumption vulnerability in Apache OFBiz affecting versions prior to 24.09.08. In multitenant deployments, the application builds a per-tenant delegator name from a user-supplied tenant ID before verifying tenant existence. The internal cache retains all delegator names requested, including invalid ones, allowing an unauthenticated attacker to submit arbitrary tenant IDs and cause unbounded cache growth, leading to increased memory and database load.
A path traversal vulnerability exists in Apache OFBiz through version 24.09.07, allowing a remote authenticated attacker with Catalog view permission to overwrite arbitrary files writable by the OFBiz process. This occurs due to missing authorization checks in the replaceImageToExistImage service and can be exploited via crafted parameters. The issue is fixed in version 24.09.08.
Apache OFBiz versions before 24.09.08 contain a missing authorization vulnerability in ProductEvents. This flaw allows a remote authenticated user with only catalog view permission to create, modify, or delete product-related data by invoking certain catalog quick-admin events. The issue arises because the servlet authorizes requests against a base view-level permission, while the underlying event methods perform write operations without verifying the required update/create permissions. Upgrading to version 24.09.08 resolves this vulnerability.
CVE-2026-76152 is a path traversal vulnerability in Apache OFBiz up to version 24.09.07. It allows a remote authenticated attacker with Catalog view permission to read arbitrary image-parsable files accessible by the OFBiz process and write re-encoded images to arbitrary writable directories. The issue is fixed in version 24.09.08.
Apache OFBiz versions before 24.09.08 contain an authorization vulnerability in ContentPermissionServices. A remote authenticated attacker with limited content-create permission can exploit this flaw to self-assign the OWNER role on arbitrary content. This occurs because the permission check incorrectly defaults to granting access when no matching ContentPurposeOperation entry is found. The OWNER role enables full control over the content, including update, removal, and status changes. The issue is fixed in version 24.09.08.
Apache OFBiz versions before 24.09.08 contain a missing authorization vulnerability in ProductSearchEvents. A remote authenticated user with only catalog view permission can bulk-modify product category and feature associations across arbitrary search results. This occurs because the servlet authorizes requests only against the base view-level permission, while underlying event methods perform bulk deletes and inserts without enforcing proper DELETE/CREATE permissions. The issue is fixed in version 24.09.08.
A SQL Injection vulnerability exists in Apache OFBiz versions before 24.09.08 on MySQL/MariaDB-backed deployments. The flaw occurs in the entity engine's generic performFind service when handling ignore-case find requests with crafted values, allowing remote unauthenticated attackers to disclose arbitrary database rows. The issue arises because the input is inlined into SQL text with insufficient escaping for MySQL/MariaDB, enabling payloads to break out of string literals. This vulnerability does not affect Derby or PostgreSQL datasources. Upgrading to version 24.09.08 resolves the issue.
An XML External Entity (XXE) injection vulnerability exists in Apache OFBiz versions before 24.09.08. A remote authenticated attacker with content-author permissions can exploit this flaw by storing crafted XML content that includes an external entity declaration. This causes the ContentWorker component to parse the XML insecurely, allowing the attacker to read arbitrary server files and trigger server-side request forgery. The issue is fixed in version 24.09.08.
CVE-2026-81828 is a Server-Side Request Forgery (SSRF) vulnerability in Apache OFBiz versions before 24.09.08. It allows an authenticated back-office user with catalog permission to specify arbitrary URLs as a product-store survey's template location. This causes the server to fetch and render attacker-controlled content, including internal network resources and local files, without validating the URL scheme or host. The malicious content is then rendered into the HTTP response for any shopper loading the affected survey, resulting in non-blind information disclosure. The issue is fixed in version 24.09.08.
Apache OFBiz versions before 24.09.08 contain an improper authorization vulnerability in the ContentWorker component. This flaw allows remote unauthenticated attackers to invoke arbitrary OFBiz services with attacker-controlled parameters, leading to arbitrary file write, file deletion, and server-side request forgery. The issue arises because the serviceName field in a Content row can be set by accounts with limited permissions, and the vulnerable code does not verify ownership or authentication before invoking the service. Upgrading to version 24.09.08 resolves this vulnerability.
Server-Side Request Forgery in ViewDataFile in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote authenticated attacker holding only the base webtools permissions (OFBTOOLS_VIEW, WEBTOOLS_VIEW) to cause the server to issue arbitrary outbound HTTP requests, and an attacker additionally holding ENTITY_MAINT and DATAFILE_MAINT to read arbitrary local files via a file: URL, by supplying the DEFINITION_LOCATION or DATAFILE_LOCATION request parameter to the viewdatafile screen, because ViewDataFile.groovy dereferences both parameters as java.net.URL objects with no scheme allow-list, host filter, or egress control inside a screen action that runs before the screen's and template's permission checks are evaluated, so the fetch executes regardless of whether the requesting account is authorized to view its result. Users are recommended to upgrade to version 24.09.08, which fixes this issue.
Uncontrolled Resource Consumption in ServiceMultiEventHandler in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote unauthenticated attacker to pin a server request thread for an attacker-chosen number of synchronous service dispatches, up to the signed-integer maximum, by submitting a single small HTTP request whose parameter names encode a row count via the "o" suffix used by multi-form submissions, because UtilHttp.getMultiFormRowCount derives that count from the largest such suffix with no upper bound and ServiceMultiEventHandler.invoke then loops that many times calling dispatcher.runSync, with the request-map for getFinAccountTransRunningTotalAndBalances reaching this handler with no authentication or CSRF requirement on a stock deployment. Users are recommended to upgrade to version 24.09.08, which fixes this issue.
Authentication Bypass by Capture-replay in ExternalLoginKeysManager in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote unauthenticated attacker who captures a live externalLoginKey value to obtain a complete, cookie-free, reusable session as the user who issued it, in every webapp that user can reach, because checkExternalLoginKey runs as a global preprocessor ahead of both the CSRF and authentication checks and accepts the key as a bearer credential that is never bound to a client, never expires, and is not invalidated after use, while the framework itself both appends live keys to every cross-webapp link it renders and, via WidgetWorker's unvalidated inter-app link target, lets an authenticated user's key be attached to an attacker-chosen absolute URL and delivered directly to the attacker's own server. Users are recommended to upgrade to version 24.09.08, which fixes this issue.
Improper Neutralization of Special Elements Used in a Template Engine ('Server-Side Template Injection') in MacroScreenRenderer in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote authenticated attacker holding only the two view permissions of a control-servlet webapp (e.g. CATALOG_VIEW and OFBTOOLS_VIEW on /catalog, held by OFBiz's own shipped order-entry clerk role) to execute arbitrary operating system commands as the OFBiz service account with a single GET request, by placing an apostrophe followed by FreeMarker expression source in a screen link parameter value, because renderLink concatenates link parameter values verbatim between apostrophes into an unquoted, unescaped template-source string that is compiled and evaluated at render time, allowing the injected expression to reach the allow-listed FlexibleStringExpander.expandString call and, through a runtime-assembled Groovy interpolation, unsandboxed code execution. Users are recommended to upgrade to version 24.09.08, which fixes this issue.
Improper Neutralization of Special Elements Used in an Expression Language Statement ('Expression Language Injection') in EmailServices in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote authenticated attacker holding only OFBTOOLS_VIEW and ACCOUNTING_VIEW, the two view-level permissions that open the Accounting application, to execute arbitrary operating system commands as the account running OFBiz, by submitting a ${groovy:...} expression as the bodyText or subject value to the shipped Send Per Email invoice form, because sendMailFromScreen passes those caller-supplied values through FlexibleStringExpander.expandString, which compiles and evaluates embedded Groovy on a class loader that carries none of the SecureASTCustomizer restrictions GroovyUtil.eval applies elsewhere, behind a service and request-map that declare no permission check beyond base authentication. Users are recommended to upgrade to version 24.09.08, which fixes this issue.
Missing Authorization in XmlDsDump in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote authenticated attacker holding only the webtools base permissions (OFBTOOLS_VIEW, WEBTOOLS_VIEW) — explicitly not the ENTITY_MAINT permission the export feature declares and visibly refuses to render for — to export the contents of any database entity, including UserLogin with its currentPassword hashes, to any filesystem path the OFBiz process can write, including a web-served docroot, and to create arbitrary directories or truncate arbitrary existing files at those paths, because the XmlDsDump screen action writes the requested entity data via new FileOutputStream on unvalidated outpath and filename request parameters before the screen's ENTITY_MAINT permission check runs, unlike the equivalent Java service entityExportAll, which enforces both a permission check and a file-path allow-list. Users are recommended to upgrade to version 24.09.08, which fixes this issue.
Improper Control of Generation of Code ('Code Injection') in ModelFormField in the Apache OFBiz cms plugin before 24.09.08 on all platforms allows a remote authenticated attacker holding only CMS content-editor access to execute arbitrary operating system commands as the OFBiz process user via a single HTTP POST request, by submitting a crafted caContentIdTo parameter to EditAddContent, because the CMS screen copies that parameter into a top-level context variable that is interpolated into a form field's use-when attribute and the resulting string is passed unvalidated to GroovyUtil.eval(), whose compile-time SecureASTCustomizer sandbox does not restrict runtime reflection, allowing a payload that closes the expanded string literal and invokes java.lang.Runtime via reflection. Users are recommended to upgrade to version 24.09.08, which fixes this issue.