Authorization Flaw in Apache OFBiz Affects Content Control

CVE-2026-81744

What is CVE-2026-81744?

An authorization flaw in Apache OFBiz 24.09 prior to version 24.09.08 leads to a potential escalation of privileges. Remote authenticated attackers, with minimal content-create permissions, can exploit the createContentRole service to self-assign the OWNER role to arbitrary content. This misconfiguration exposes the system to serious security risks, as attackers can then bypass permission checks, gaining full control over content, including capabilities to read, update, and delete. It is highly recommended for users to upgrade to the latest version to mitigate this vulnerability.

References