REST API Authentication Bypass in Apache OFBiz Framework

CVE-2026-92887

What is CVE-2026-92887?

A critical flaw exists in the default value handling within the REST API framework's .rest.xml definition parser in Apache OFBiz. This vulnerability allows an unauthorized remote attacker to trigger REST API operations without valid authentication. The issue arises when the .rest.xml resource or operation definition fails to include the auth attribute, leading the ModelApiReader to incorrectly interpret the authentication requirement as false instead of adhering to the declared true default stated in rest-api.xsd. It is essential for users to upgrade to version 24.09.08 to mitigate this risk.

References