{"id":"CVE-2026-100168","kind":"vulnerability","aliases":["CVE-2026-100168"],"related":[],"title":"Apache OFBiz: view-only users can re-parent content via moveContentJson","description":"Direct Request ('Forced Browsing') in the Content Manager component in Apache OFBiz 24.09.07 on all platforms allows an authenticated user holding only view-only content permissions (OFBTOOLS_VIEW and CONTENTMGR_VIEW) to re-parent content associations they do not own or manage via a direct POST request to the moveContentJson endpoint, which performs no permission check, unlike the equivalent updateContent/createContentAssoc/removeContentAssoc services that require genericContentPermission UPDATE. Users are recommended to upgrade to version 24.09.08, which fixes this issue.","summary":"Apache OFBiz 24.09.07 has a missing permission check on the moveContentJson endpoint in the Content Manager component. A logged-in user with only view permissions can send a direct POST request to move content associations they do not manage.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["apache-ofbiz","java","runtime","self-hosted"],"not_affected_if":["auth-required","no-content-manager"],"how_to_check":"- Confirm the installed version with the OFBiz release files or `grep -r \"24.09\" framework/base/config/ofbiz-container.properties` (unknown if this exact path is correct for your install)\n- Check whether your deployment exposes the Content Manager (`/content`) to users who hold only OFBTOOLS_VIEW or CONTENTMGR_VIEW","fix":"- Apache OFBiz: upgrade to `24.09.08`","status":"open","published_at":"2026-11-05T14:16:58+00:00","first_seen_at":"2026-11-05T14:39:16+00:00","triaged_at":"2026-11-05T14:41:00+00:00","updated_at":"2026-11-05T14:41:00+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-11-05T14:41:00Z","model":"claude-haiku-5-5","output":{"fix":"- Apache OFBiz: upgrade to `24.09.08`","reach":"network","title":"Apache OFBiz: view-only users can re-parent content via moveContentJson","impact":"low","summary":"Apache OFBiz 24.09.07 has a missing permission check on the moveContentJson endpoint in the Content Manager component. A logged-in user with only view permissions can send a direct POST request to move content associations they do not manage.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["apache-ofbiz","self-hosted","java"],"confidence":0.6,"fix_status":"available","needs_auth":"yes","worst_case":"View-only user alters content association structure without permission","analyst_note":"","how_to_check":"- Confirm the installed version with the OFBiz release files or `grep -r \"24.09\" framework/base/config/ofbiz-container.properties` (unknown if this exact path is correct for your install)\n- Check whether your deployment exposes the Content Manager (`/content`) to users who hold only OFBTOOLS_VIEW or CONTENTMGR_VIEW","plain_action":"","needs_analyst":false,"not_affected_if":["auth-required","no-content-manager"],"who_is_affected":"Teams running Apache OFBiz 24.09.07 where some users hold view-only content permissions (OFBTOOLS_VIEW or CONTENTMGR_VIEW) in the Content Manager. The exposure requires a valid login, so deployments where only fully trusted staff can sign in carry less risk. Teams on other OFBiz versions or without the Content Manager component can skip it.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000731,"input_tokens":4334,"output_tokens":596,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-100168':16A,19A '-2026':15A,18A '24.09.07':30B,80C '24.09.08':142C 'allow':84C 'apach':1A,21B,28B,78C 'apache-ofbiz':20B 'associ':63B,105C 'authent':86C 'brows':71C 'check':35B,125C 'compon':44B,76C 'content':11A,42B,62B,74C,93C,104C 'contentmgr':98C 'cve':14A,17A 'direct':57B,68C,114C 'endpoint':39B,120C 'equival':128C 'fix':144C 'forc':70C 'genericcontentpermiss':133C 'hold':88C 'host':27B 'issu':146C 'java':23B 'log':47B 'logged-in':46B 'manag':43B,67B,75C,111C 'miss':33B 'move':61B 'movecontentjson':13A,38B,119C 'ofbiz':2A,22B,29B,79C 'ofbtool':95C 'parent':10A,103C 'perform':122C 'permiss':34B,53B,94C,124C 'platform':83C 'post':58B,115C 're':9A,102C 're-par':8A,101C 'recommend':137C 'request':59B,69C,116C 'requir':132C 'runtim':24B 'self':26B 'self-host':25B 'send':55B 'servic':130C 'unlik':126C 'updat':134C 'updatecontent/createcontentassoc/removecontentassoc':129C 'upgrad':139C 'user':6A,49B,87C,135C 'version':141C 'via':12A,112C 'view':4A,52B,91C,96C,99C 'view-on':3A,90C","nicknames":[],"mitigations":[],"who_affected":"Teams running Apache OFBiz 24.09.07 where some users hold view-only content permissions (OFBTOOLS_VIEW or CONTENTMGR_VIEW) in the Content Manager. The exposure requires a valid login, so deployments where only fully trusted staff can sign in carry less risk. Teams on other OFBiz versions or without the Content Manager component can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["apacheofbiz","java","medium","runtime","selfhosted"],"campaign_type":null,"first_public_at":"2026-11-05T14:16:58+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-100168","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100168","severity":null,"published_at":"2026-11-05T14:16:58+00:00","modified_at":"2026-11-05T14:16:58+00:00","first_seen_at":"2026-11-05T14:39:16+00:00","fetched_at":"2026-11-05T14:39:16+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}