Authorization Vulnerability in Apache OFBiz Human Resources Data Access
CVE-2026-73580

Currently unrated

Key Information:

Vendor

Apache
Status
Apache Ofbiz
Vendor
CVE Published:
5 November 2026

What is CVE-2026-73580?

A missing authorization check in the getHRChild service of Apache OFBiz prior to version 24.09.08 permits remote unauthenticated attackers to access and enumerate sensitive Human Resources data. This includes critical information such as department names, employment positions, and employee identifiers via a crafted partyId parameter. It is strongly recommended for users to upgrade to version 24.09.08 to rectify this vulnerability and safeguard against unauthorized data exposure.

Affected Version(s)

Apache OFBiz 0 < 24.09.08

References

https://lists.apache.org/thread.html/7b2syzksp7klt9fvhdg0...
vendor-advisory

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Omar Mousa — Red Team & Security Researcher
Krishna Uprit
.