CVE-2026-100168 · Runtime
NO FIX YET · SEE WHAT TO DO
Apache OFBiz 24.09.07 has a missing permission check on the moveContentJson endpoint in the Content Manager component. A logged-in user with only view permissions can send a direct POST request to move content associations they do not manage.
first public Nov 5, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Teams running Apache OFBiz 24.09.07 where some users hold view-only content permissions (OFBTOOLS_VIEW or CONTENTMGR_VIEW) in the Content Manager. The exposure requires a valid login, so deployments where only fully trusted staff can sign in carry less risk. Teams on other OFBiz versions or without the Content Manager component can skip it.
Not affected if auth-required, no-content-manager
Who cares apache-ofbiz, java, self-hosted
grep -r "24.09" framework/base/config/ofbiz-container.properties (unknown if this exact path is correct for your install)/content) to users who hold only OFBTOOLS_VIEW or CONTENTMGR_VIEW24.09.08Direct Request ('Forced Browsing') in the Content Manager component in Apache OFBiz 24.09.07 on all platforms allows an authenticated user holding only view-only content permissions (OFBTOOLS_VIEW and CONTENTMGR_VIEW) to re-parent content associations they do not own or manage via a direct POST request to the moveContentJson endpoint, which performs no permission check, unlike the equivalent updateContent/createContentAssoc/removeContentAssoc services that require genericContentPermission UPDATE. Users are recommended to upgrade to version 24.09.08, which fixes this issue.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.