CVE-2026-114272 · Runtime
NO FIX YET · SEE WHAT TO DO
Apache OFBiz 24.09 before 24.09.08 has an authorization bypass in its content viewing component. An authenticated user with content view permission can read data of content they are not authorized to see by combining a viewable contentId with another item's dataResourceId.
first public Nov 5, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Deployments of Apache OFBiz 24.09 before 24.09.08 on all platforms where users hold role-scoped content view permission. The attacker must already be an authenticated user, so deployments without such accounts are lower risk. Managed or fully internal deployments with no untrusted accounts can deprioritize it.
Not affected if auth-required, no-content-view-roles, not-24.09
Who cares apache-ofbiz, java, self-hosted
24.09 below 24.09.08.24.09.08.Authorization Bypass Through User-Controlled Key in the content viewing component in Apache OFBiz 24.09 before 24.09.08 on all platforms allows an authenticated user with role-scoped content view permission to read the data of content they are not authorized to view via a ViewSimpleContent request that combines a contentId they can view with the dataResourceId of other content. Users are recommended to upgrade to version 24.09.08, which fixes this issue.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.