Incorrect Authorization in Apache OFBiz Affects Multiple Tenants

CVE-2026-84728

What is CVE-2026-84728?

A vulnerability in Apache OFBiz versions prior to 24.09.08 allows a remote authenticated attacker with a low-privilege account to manipulate tenant isolation. When multitenancy is enabled, the attacker can exploit this flaw to read and write data belonging to a different tenant. By using their tenant's userTenantId combined with their credentials at the Party Manager login, the attacker can bypass authorization checks. This occurs because the system gives priority to the conflicting userTenantId request parameter, which can lead to unauthorized access and data exposure from the affected tenant. Upgrading to version 24.09.08 is recommended to mitigate this risk.

References