Missing Authorization Vulnerability in Apache OFBiz by Apache
CVE-2026-83538

Currently unrated

Key Information:

Vendor

Apache
Status
Apache Ofbiz
Vendor
CVE Published:
5 November 2026

What is CVE-2026-83538?

A missing authorization vulnerability in Apache OFBiz versions prior to 24.09.08 permits remote, unauthenticated attackers to access sensitive internal business records. This includes vital information such as organizational data, employee details, product catalogs, and product-store information. The affected applications within OFBiz, such as Human Resources, Catalog, and Order Manager, fail to enforce proper authentication and permission checks on several helper endpoints, enabling unauthorized access. Users should ensure they upgrade to version 24.09.08 to mitigate this risk.

Affected Version(s)

Apache OFBiz 0 < 24.09.08

References

https://lists.apache.org/thread.html/7b2syzksp7klt9fvhdg0...
vendor-advisory

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Jonah Burgess (CryptoCat)
Krishna Uprit
.