Authorization Flaw in Apache OFBiz Affects Remote Security

CVE-2026-73577

What is CVE-2026-73577?

An authorization flaw exists in the RequestHandler of Apache OFBiz 24.09, allowing remote attackers to bypass authentication on protected views. This vulnerability arises when they append a protected view as a path suffix to a public request, resulting in improper authorization based solely on the public path component. This misconfiguration could lead to unauthorized access to sensitive information. Users are advised to update to version 24.09.08 to remedy this security risk.

References