{"id":"CVE-2026-114272","kind":"vulnerability","aliases":["CVE-2026-114272"],"related":[],"title":"Apache OFBiz: content viewing lets users read other content they lack access to","description":"Authorization Bypass Through User-Controlled Key in the content viewing component in Apache OFBiz 24.09 before 24.09.08 on all platforms allows an authenticated user with role-scoped content view permission to read the data of content they are not authorized to view via a ViewSimpleContent request that combines a contentId they can view with the dataResourceId of other content.\nUsers are recommended to upgrade to version 24.09.08, which fixes this issue.","summary":"Apache OFBiz 24.09 before 24.09.08 has an authorization bypass in its content viewing component. An authenticated user with content view permission can read data of content they are not authorized to see by combining a viewable contentId with another item's dataResourceId.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["apache-ofbiz","java","runtime","self-hosted"],"not_affected_if":["auth-required","no-content-view-roles","not-24.09"],"how_to_check":"- Check the installed OFBiz version and confirm whether it is `24.09` below `24.09.08`.\n- Review whether users with role-scoped content view permission exist in the deployment.","fix":"- Upgrade Apache OFBiz 24.09 to `24.09.08`.","status":"open","published_at":"2026-11-05T14:17:01+00:00","first_seen_at":"2026-11-05T14:39:17+00:00","triaged_at":"2026-11-05T14:40:47+00:00","updated_at":"2026-11-05T14:40:47+00:00","category":"runtime","confidence":0.7,"triage":{"at":"2026-11-05T14:40:47Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Apache OFBiz 24.09 to `24.09.08`.","reach":"network","title":"Apache OFBiz: content viewing lets users read other content they lack access to","impact":"medium","summary":"Apache OFBiz 24.09 before 24.09.08 has an authorization bypass in its content viewing component. An authenticated user with content view permission can read data of content they are not authorized to see by combining a viewable contentId with another item's dataResourceId.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["apache-ofbiz","java","self-hosted"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"authenticated user reads content data they are not authorized to view","analyst_note":"","how_to_check":"- Check the installed OFBiz version and confirm whether it is `24.09` below `24.09.08`.\n- Review whether users with role-scoped content view permission exist in the deployment.","plain_action":"","needs_analyst":false,"not_affected_if":["not-24.09","auth-required","no-content-view-roles"],"who_is_affected":"Deployments of Apache OFBiz 24.09 before 24.09.08 on all platforms where users hold role-scoped content view permission. The attacker must already be an authenticated user, so deployments without such accounts are lower risk. Managed or fully internal deployments with no untrusted accounts can deprioritize it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000693,"input_tokens":4268,"output_tokens":533,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-114272':15A,18A '-2026':14A,17A '24.09':29B,84C '24.09.08':31B,86C,137C 'access':12A 'allow':90C 'anoth':65B 'apach':1A,20B,27B,82C 'apache-ofbiz':19B 'authent':42B,92C 'author':34B,56B,69C,110C 'bypass':35B,70C 'combin':60B,118C 'compon':40B,80C 'content':3A,9A,38B,45B,52B,78C,98C,106C,129C 'contentid':63B,120C 'control':74C 'cve':13A,16A 'data':50B,104C 'dataresourceid':68B,126C 'fix':139C 'host':26B 'issu':141C 'item':66B 'java':22B 'key':75C 'lack':11A 'let':5A 'ofbiz':2A,21B,28B,83C 'permiss':47B,100C 'platform':89C 'read':7A,49B,102C 'recommend':132C 'request':116C 'role':96C 'role-scop':95C 'runtim':23B 'scope':97C 'see':58B 'self':25B 'self-host':24B 'upgrad':134C 'user':6A,43B,73C,93C,130C 'user-control':72C 'version':136C 'via':113C 'view':4A,39B,46B,79C,99C,112C,123C 'viewabl':62B 'viewsimplecont':115C","nicknames":[],"mitigations":[],"who_affected":"Deployments of Apache OFBiz 24.09 before 24.09.08 on all platforms where users hold role-scoped content view permission. The attacker must already be an authenticated user, so deployments without such accounts are lower risk. Managed or fully internal deployments with no untrusted accounts can deprioritize it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["apacheofbiz","java","medium","runtime","selfhosted"],"campaign_type":null,"first_public_at":"2026-11-05T14:17:01+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-114272","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114272","severity":null,"published_at":"2026-11-05T14:17:01+00:00","modified_at":"2026-11-05T14:17:01+00:00","first_seen_at":"2026-11-05T14:39:17+00:00","fetched_at":"2026-11-05T14:39:17+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}