Missing Authorization in Apache OFBiz Allows Unauthorized Bulk Modifications

CVE-2026-81808

What is CVE-2026-81808?

A vulnerability exists in Apache OFBiz 24.09 prior to version 24.09.08, which enables a remote authenticated attacker, possessing only catalog view permission, to execute bulk modifications on product category and feature associations. By conducting a broad product search, the attacker can invoke mutation events such as searchRemoveFromCategory and searchAddFeature, leading the servlet to authorize actions based on an insufficient view-level permission. This oversight allows the attacker to bypass service-layer permissions that should safeguard against unauthorized DELETE and CREATE operations. It is crucial for users to upgrade to version 24.09.08 to mitigate this vulnerability effectively.

References