CVE-2026-71901 · Package
NO FIX YET · SEE WHAT TO DO
An authenticated user with access to the SFA component can override which service a vCard import uses, reaching other services they should not call. The attacker gets the privileges of those other services within OFBiz.
first public Nov 5, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Organizations running Apache OFBiz before 24.09.08 where users have access to the SFA (sales force automation) component. Exposure requires a valid account with SFA access; instances without SFA in use or without untrusted authenticated users are lower risk.
Not affected if no-untrusted-users, sfa-unused, version-24.09.08-or-later
Who cares apache-ofbiz, erp, self-hosted
24.09.08.24.09.08.Improper Control of Resource Identifiers ('Resource Injection') vulnerability in Apache OFBiz.
An authenticate user with access to sfa component can override the service to use on vcard import and access to other service.
This issue affects Apache OFBiz: before 24.09.08.
Users are recommended to upgrade to version 24.09.08, which fixes the issue.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.