Missing Authorization Vulnerability in Apache OFBiz by Apache
CVE-2026-82916

7.1HIGH

Key Information:

Vendor

Apache
Status
Apache Ofbiz
Vendor
CVE Published:
5 November 2026

What is CVE-2026-82916?

A missing authorization vulnerability has been identified in the XmlDsDump feature of Apache OFBiz versions prior to 24.09.08. This flaw allows remote authenticated users with minimal webtools permissions to export sensitive database entries, including user credentials, to arbitrary locations on the server. The weakness arises from improperly validated output parameters which permit exploitation of the export feature, enabling attackers to create directories or overwrite files on the server. To mitigate risks associated with this vulnerability, it is crucial for users to upgrade to version 24.09.08, which addresses the authorization checks to ensure secure data handling.

Affected Version(s)

Apache OFBiz 0 < 24.09.08

References

https://lists.apache.org/thread.html/7b2syzksp7klt9fvhdg0...
vendor-advisory

CVSS V3.1

Score:
7.1
Severity:
HIGH
Confidentiality:
High
Integrity:
Low
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Bartlomiej Dmitruk at striga.ai
Krishna Uprit
.