{"id":"CVE-2026-71901","kind":"vulnerability","aliases":["CVE-2026-71901"],"related":[],"title":"Apache OFBiz: authenticated SFA users can invoke other services via vcard import","description":"Improper Control of Resource Identifiers ('Resource Injection') vulnerability in Apache OFBiz.\n\n\n\nAn authenticate user with access to sfa component can override the service to use on vcard import and access to other service.\n\n\n\nThis issue affects Apache OFBiz: before 24.09.08.\n\n\n\nUsers are recommended to upgrade to version 24.09.08, which fixes the issue.","summary":"An authenticated user with access to the SFA component can override which service a vCard import uses, reaching other services they should not call. The attacker gets the privileges of those other services within OFBiz.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["apache-ofbiz","erp","package","self-hosted"],"not_affected_if":["no-untrusted-users","sfa-unused","version-24.09.08-or-later"],"how_to_check":"- Check the installed OFBiz version; the issue affects versions before `24.09.08`.\n- Confirm whether the SFA component is in use and which users have access to it.","fix":"- Upgrade Apache OFBiz to `24.09.08`.","status":"open","published_at":"2026-11-05T15:17:22+00:00","first_seen_at":"2026-11-05T15:39:21+00:00","triaged_at":"2026-11-05T15:41:01+00:00","updated_at":"2026-11-05T15:41:01+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-05T15:41:01Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Apache OFBiz to `24.09.08`.","reach":"network","title":"Apache OFBiz: authenticated SFA users can invoke other services via vcard import","impact":"medium","summary":"An authenticated user with access to the SFA component can override which service a vCard import uses, reaching other services they should not call. The attacker gets the privileges of those other services within OFBiz.","audience":"businesses","category":"package","nicknames":[],"who_cares":["apache-ofbiz","self-hosted","erp"],"confidence":0.6,"fix_status":"available","needs_auth":"yes","worst_case":"authenticated user reaches services beyond their permissions","analyst_note":"","how_to_check":"- Check the installed OFBiz version; the issue affects versions before `24.09.08`.\n- Confirm whether the SFA component is in use and which users have access to it.","plain_action":"","needs_analyst":false,"not_affected_if":["version-24.09.08-or-later","sfa-unused","no-untrusted-users"],"who_is_affected":"Organizations running Apache OFBiz before 24.09.08 where users have access to the SFA (sales force automation) component. Exposure requires a valid account with SFA access; instances without SFA in use or without untrusted authenticated users are lower risk.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000666,"input_tokens":4238,"output_tokens":485,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-71901':15A,18A '24.09.08':101C,109C 'access':31B,77C,91C 'affect':97C 'apach':1A,20B,71C,98C 'apache-ofbiz':19B 'attack':52B 'authent':3A,28B,74C 'call':50B 'compon':35B,80C 'control':63C 'cve':13A,16A 'erp':22B 'fix':111C 'get':53B 'host':26B 'identifi':66C 'import':12A,42B,89C 'improp':62C 'inject':68C 'invok':7A 'issu':96C,113C 'ofbiz':2A,21B,61B,72C,99C 'overrid':37B,82C 'packag':23B 'privileg':55B 'reach':44B 'recommend':104C 'resourc':65C,67C 'self':25B 'self-host':24B 'servic':9A,39B,46B,59B,84C,94C 'sfa':4A,34B,79C 'upgrad':106C 'use':43B,86C 'user':5A,29B,75C,102C 'vcard':11A,41B,88C 'version':108C 'via':10A 'vulner':69C 'within':60B","nicknames":[],"mitigations":[],"who_affected":"Organizations running Apache OFBiz before 24.09.08 where users have access to the SFA (sales force automation) component. Exposure requires a valid account with SFA access; instances without SFA in use or without untrusted authenticated users are lower risk.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["apacheofbiz","erp","medium","package","selfhosted"],"campaign_type":null,"first_public_at":"2026-11-05T15:17:22+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-71901","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-71901","severity":null,"published_at":"2026-11-05T15:17:22+00:00","modified_at":"2026-11-05T15:17:22+00:00","first_seen_at":"2026-11-05T15:39:21+00:00","fetched_at":"2026-11-05T15:39:21+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}