Improper Control of Resource Identifiers in Apache OFBiz
CVE-2026-71901

Currently unrated

Key Information:

Vendor: Apache
Status: Apache Ofbiz
Vendor: CVE Published:; 5 November 2026

What is CVE-2026-71901?

A vulnerability exists in Apache OFBiz allowing authenticated users with access to the SFA component to manipulate the service utilized during vCard import operations. This manipulation may lead to unauthorized access to other services. Users are strongly advised to upgrade to version 24.09.08 to mitigate this issue.

Affected Version(s)

Apache OFBiz 0 < 24.09.08

References

https://lists.apache.org/thread.html/7b2syzksp7klt9fvhdg0...

vendor-advisory

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
Nov 5, 2026
Vulnerability Reserved
Aug 8, 2026

Credit

Charles Vosburgh <trilobyte777@gmail.com>

Bartlomiej Dmitruk at striga.ai

CVE-2026-71901 Data

JSON