Apache OFBiz versions prior to 24.09.08 contain a missing authorization vulnerability that allows remote unauthenticated attackers to access internal business records without permission. This affects several helper endpoints in the Human Resources, Catalog, and Order Manager applications, exposing sensitive data such as organization details, employee information, product catalog, and product-store data. The issue is fixed in version 24.09.08.
CVE-2026-123028 is a SQL injection vulnerability in itsourcecode Online Book Store version 1.0. The flaw exists in the /admin_edit.php file where the bookisbn parameter can be manipulated to execute unauthorized SQL commands. This vulnerability can be exploited remotely without authentication. Public exploit code is available, increasing the risk of exploitation.
A vulnerability in ChatGPT's Lockdown Mode allows attackers to bypass its protections and perform silent exfiltration of chat data, phishing, and malware delivery. The flaw exploits the HTML page preview feature in ChatGPT code blocks, enabling attackers to open pop-up windows outside the sandbox, exfiltrate entire chat histories without user interaction, and display phishing content. This bypass undermines Lockdown Mode's restrictions on outbound network requests and content loading. The attack surface includes data theft, social engineering via interface manipulation, and malware distribution within the trusted ChatGPT interface.
Improper Control of Generation of Code ('Code Injection') in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote unauthenticated attacker to execute arbitrary code on the server by staging crafted widget XML in a multipart upload and overriding the mainDecoratorLocation used by a manager login route through an anonymous JSON request, causing OFBiz to load the staged XML through its live screen descriptor mechanism and evaluate an unsandboxed Groovy expression while rendering the authentication-failure page. Further validation established the following:
-- The exploit does not require a malformed or incomplete multipart body: a well-formed multipart request that is kept in flight and then allowed to complete normally is sufficient.
-- The screen loader reads the widget XML from a live process file descriptor while the upload is streaming, rather than from any file the attacker persists to disk.
-- The same underlying issue is also reachable through the public, explicitly unauthenticated /sfa/control/editPortalPageColumnWidth route, returning command output directly in an HTTP 200 response — it is not limited to the login-failure rendering path used in the original report.
Users are recommended to upgrade to version 24.09.08, which fixes this issue.
Incorrect Authorization in the updateLayout simple-method in applications/content/minilang/layout/LayoutEvents.xml in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote authenticated attacker holding only OFBTOOLS_VIEW and CONTENTMGR_VIEW to execute arbitrary commands as the OFBiz process user, by using updateLayout's authorization check — which validates only the fixed CONTENT_CREATE operation rather than an update permission on the actual Content record and an independently selected DataResource — to relink an existing RESPONSE-purpose Content record and convert an arbitrary, independently selected DataResource into an OFBIZ_FILE/FTL resource pointed at the OFBiz access log, poisoned via a crafted User-Agent header and evaluated through the normal authenticated showContent route. Users are recommended to upgrade to version 24.09.08, which fixes this issue.
Incorrect Authorization in Apache OFBiz
24.09 before 24.09.08 on all platforms, when documented multitenancy is
enabled, allows a remote authenticated attacker holding only a valid
low-privilege account in one tenant to read and write data belonging to a
different tenant, by submitting their own tenant's userTenantId
alongside their own credentials to the normal Party Manager login
against a hostname mapped to a different tenant: ContextFilter resolves
the tenant from the hostname via TenantDomainName, but LoginWorker gives
priority to the conflicting userTenantId request parameter and
authenticates against the attacker's own tenant, so a subsequent
ordinary request to the same hostname combines the hostname-mapped
tenant's Entity Engine delegator with the attacker's tenant's session
dispatcher, security object, and identity, letting the permission check
run against the attacker's own tenant while the resulting read or write
is performed against the hostname-mapped tenant's data. Users are
recommended to upgrade to version 24.09.08, which fixes this issue.
CVE-2026-85627 is a server-side template injection vulnerability in Apache OFBiz versions before 24.09.08. It allows a remote authenticated user with a non-administrative account to execute arbitrary OS commands as the OFBiz process user by exploiting improper neutralization of special elements in the template engine. The issue is fixed in version 24.09.08.
CVE-2026-76563 is a cross-site scripting (XSS) vulnerability in Fileorbis Informatics Services Trade Inc.'s Fileorbis product. The flaw involves improper neutralization of script-related HTML tags, allowing malicious files to execute scripts in a web page context. This vulnerability affects all versions prior to 12.5.4. It has a CVSS 3.1 base score of 6.1, indicating a medium severity level. No known exploits are reported in the wild. The issue is fixed in version 12.5.4.
Apache OFBiz versions prior to 24.09.08 contain a vulnerability in the REST API framework's ModelApiReader parser. Due to an incorrect default value for the auth attribute in .rest.xml definitions, unauthenticated remote attackers can invoke REST API operations without valid credentials. This occurs because ModelApiReader incorrectly treats the missing auth attribute as false, allowing unauthorized access. The issue is fixed in version 24.09.08.
Apache OFBiz versions prior to 24.09.08 contain a hard-coded password vulnerability in the AdminServer component. This flaw allows an attacker who can access the AdminServer control port to query the server's running state and perform an unauthenticated shutdown of the instance using the fixed default control key. The issue is resolved in version 24.09.08.
CVE-2026-123024 is a medium-severity vulnerability in agentscope-ai AgentScope versions 2.0.0 through 2.0.11. It affects the get_current_user_id function in the Agent Service component, where manipulation of the X-User-ID argument leads to missing authentication. This flaw allows remote attackers to bypass authentication controls. A fix has been proposed but is not yet accepted or available.
CVE-2026-97356 is a vulnerability in Apache OFBiz 24.09.07 and earlier that allows an authenticated user with LABEL_MANAGER_VIEW permission to read arbitrary properties and XML files on the server via the fileName parameter in the ViewFile component. This includes access to the JWT signing key, enabling forgery of administrator sessions. The issue is fixed in version 24.09.08.
Apache OFBiz versions prior to 24.09.08 contain a forced browsing vulnerability in the Content Manager component. Authenticated users with only view permissions can re-parent content associations they do not own by sending a direct POST request to the moveContentJson endpoint, which lacks proper permission checks. This issue is fixed in version 24.09.08.
Apache OFBiz versions prior to 24.09.08 contain an improper input validation vulnerability in the Order Returns functionality. This flaw allows an authenticated user without the ORDERMGR_CREATE permission to set an arbitrary price on a return item via the createReturnItem service, bypassing the intended server-enforced price ceiling. The issue is fixed in version 24.09.08.
A vulnerability in Apache OFBiz prior to version 24.09.08 allows users with only ACCOUNTING_VIEW permission to update or create PaymentApplication records due to missing permission checks. This issue is classified as CWE-425 (Forced Browsing).
Apache OFBiz versions 24.09.06 and 24.09.07 contain a hard-coded cryptographic key vulnerability in JWT token authentication. This flaw allows an unauthenticated attacker with network access to gain full administrative privileges by forging a JWT signed with the default security.token.key. The issue affects deployments upgraded from versions before CVE-2026-31986 that retained their original security.properties with security.internal.sso.enabled set to true. The vulnerability is fixed in version 24.09.08. Users must upgrade and run './gradlew rotateSecretKeys' to replace any existing hard-coded keys.
A vulnerability in Apache OFBiz prior to version 24.09.08 allows users with only ORDERMGR_VIEW permission to update orders due to a missing permission check (CWE-425 Forced Browsing). The issue is fixed in version 24.09.08.
Apache OFBiz versions prior to 24.09.08 contain an authorization bypass vulnerability in the Order Manager component. Authenticated users with only view-level order permissions can modify or create OrderPaymentPreference records for orders outside their authorized scope by supplying an orderPaymentPreferenceId of a different order. This issue is fixed in version 24.09.08.
CVE-2026-109837 is an authorization bypass vulnerability in Apache OFBiz versions prior to 24.09.08. It allows an authenticated user with low-privileged Order Manager access to associate another party's OrderItem with a ReturnItem on a ReturnHeader they control via the createReturnItem service. The issue is fixed in version 24.09.08.
Apache OFBiz versions before 24.09.08 contain a forced browsing vulnerability that allows authenticated users with low privileges to perform unauthorized financial account operations. These operations include creating, modifying, and canceling financial account transactions and balances via direct service requests. The issue is fixed in version 24.09.08.