---
id: "CVE-2024-38856"
kind: "vulnerability"
aliases: ["CVE-2024-38856"]
title: "Incorrect Authorization vulnerability in Apache OFBiz"
severity: "critical"
cvss: 9.8
epss: null
exploited: true
status: "open"
category: "package"
products: [{"name": "apache ofbiz", "fixed": ["18.12.15"], "affected": "< 18.12.15", "ecosystem": "vendor"}, {"name": "Apache OFBiz", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["apache-ofbiz", "exploited", "java", "package", "self-hosted"]
not_affected_if: ["not-running-ofbiz"]
published_at: "2024-08-05T09:15:56+00:00"
first_seen_at: "2026-10-23T19:11:51+00:00"
updated_at: "2026-10-24T00:09:51+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-38856", "first_seen_at": "2026-10-23T19:11:51+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-38856", "first_seen_at": "2026-10-23T22:29:05+00:00"}]
---

# Incorrect Authorization vulnerability in Apache OFBiz

Apache OFBiz, an open-source ERP suite, has an incorrect authorization flaw that lets an unauthenticated remote attacker send a Groovy payload. That payload runs as the OFBiz process, which means remote code execution on the server.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:apache ofbiz affected < 18.12.15 fixed 18.12.15
- vendor:Apache OFBiz affected ? fixed ?

## Fix

Upgrade Apache OFBiz to a fixed release per the Apache advisory, or apply the vendor mitigation; the sources do not name the exact fixed version.

## Timeline

- 2026-10-23T19:11:51+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-38856
- 2026-10-23T22:29:05+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2024-38856

## From the sources

Incorrect Authorization vulnerability in Apache OFBiz.

This issue affects Apache OFBiz: through 18.12.14.

Users are recommended to upgrade to version 18.12.15, which fixes the issue.

Unauthenticated endpoints could allow execution of screen rendering code of screens if some preconditions are met (such as when the screen definitions don't explicitly check user's permissions because they rely on the configuration of their endpoints).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_