---
id: "CVE-2026-114272"
kind: "vulnerability"
aliases: ["CVE-2026-114272"]
title: "Apache OFBiz: content viewing lets users read other content they lack access to"
severity: "medium"
cvss: null
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["apache-ofbiz", "java", "runtime", "self-hosted"]
not_affected_if: ["auth-required", "no-content-view-roles", "not-24.09"]
published_at: "2026-11-05T14:17:01+00:00"
first_seen_at: "2026-11-05T14:39:17+00:00"
updated_at: "2026-11-05T14:40:47+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-114272", "first_seen_at": "2026-11-05T14:39:17+00:00"}]
exploit_sources: []
---

# Apache OFBiz: content viewing lets users read other content they lack access to

Apache OFBiz 24.09 before 24.09.08 has an authorization bypass in its content viewing component. An authenticated user with content view permission can read data of content they are not authorized to see by combining a viewable contentId with another item's dataResourceId.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed OFBiz version and confirm whether it is `24.09` below `24.09.08`.
- Review whether users with role-scoped content view permission exist in the deployment.

## Fix

- Upgrade Apache OFBiz 24.09 to `24.09.08`.

## Timeline

- 2026-11-05T14:39:17+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-114272

## From the sources

Authorization Bypass Through User-Controlled Key in the content viewing component in Apache OFBiz 24.09 before 24.09.08 on all platforms allows an authenticated user with role-scoped content view permission to read the data of content they are not authorized to view via a ViewSimpleContent request that combines a contentId they can view with the dataResourceId of other content.
Users are recommended to upgrade to version 24.09.08, which fixes this issue.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_