Direct Request Flaw in Apache OFBiz Content Manager

CVE-2026-100168

What is CVE-2026-100168?

A vulnerability exists in the Content Manager component of Apache OFBiz 24.09.07, allowing authenticated users with limited permissions to manipulate content associations through direct POST requests to the moveContentJson endpoint. This endpoint lacks the necessary permission checks, enabling unauthorized alterations that should be restricted only to users with appropriate management rights. To mitigate this risk, users are advised to upgrade to version 24.09.08, which addresses this vulnerability.

References