Authorization Flaw in Product Management of Apache OFBiz by Apache

CVE-2026-81734

What is CVE-2026-81734?

A missing authorization vulnerability has been identified in Apache OFBiz version 24.09 prior to 24.09.08. This flaw allows a remote authenticated attacker with mere catalog view permissions to unauthorizedly create, modify, or delete product-related data. Specifically, the vulnerability occurs during the execution of catalog quick-admin events, where the authorization checks are inadequately performed. As a result, attackers can manipulate product associations and categories without the appropriate permissions. To mitigate this security risk, it is recommended that users upgrade to version 24.09.08, which addresses and resolves this issue effectively.

References