Authorization Bypass Vulnerability in Apache OFBiz Software

CVE-2026-73578

What is CVE-2026-73578?

A vulnerability in Apache OFBiz prior to version 24.09.08 allows remote unauthenticated attackers to exploit missing authorization enforcement in the RequestHandler.renderView function. By providing a specially crafted LAST_VIEW_NAME value, an attacker can bypass the request-map authentication policy for protected views. This flaw enables access to sensitive business data stored in protected views, potentially leading to severe security breaches. It is crucial for users to upgrade to version 24.09.08 or later to mitigate this risk.

References