Improper Authorization Vulnerability in Apache OFBiz by Apache

CVE-2026-82894

What is CVE-2026-82894?

An improper authorization vulnerability exists in Apache OFBiz 24.09 prior to 24.09.08, which allows remote unauthenticated attackers to exploit the ContentWorker. By manipulating the public showHelpPublic view, attackers can invoke arbitrary OFBiz services with tailored parameters. This flaw permits dangerous actions such as arbitrary file writes and deletions, alongside potential server-side request forgery. The vulnerability is rooted in the lack of checks on the service invocation process, as it allows the resolution of services from user-controlled input without authentication or authorization checks. To mitigate these risks, it is advisable for users to upgrade to version 24.09.08 or later.

References