---
id: "CVE-2026-71901"
kind: "vulnerability"
aliases: ["CVE-2026-71901"]
title: "Apache OFBiz: authenticated SFA users can invoke other services via vcard import"
severity: "medium"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["apache-ofbiz", "erp", "package", "self-hosted"]
not_affected_if: ["no-untrusted-users", "sfa-unused", "version-24.09.08-or-later"]
published_at: "2026-11-05T15:17:22+00:00"
first_seen_at: "2026-11-05T15:39:21+00:00"
updated_at: "2026-11-05T15:41:01+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-71901", "first_seen_at": "2026-11-05T15:39:21+00:00"}]
exploit_sources: []
---

# Apache OFBiz: authenticated SFA users can invoke other services via vcard import

An authenticated user with access to the SFA component can override which service a vCard import uses, reaching other services they should not call. The attacker gets the privileges of those other services within OFBiz.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed OFBiz version; the issue affects versions before `24.09.08`.
- Confirm whether the SFA component is in use and which users have access to it.

## Fix

- Upgrade Apache OFBiz to `24.09.08`.

## Timeline

- 2026-11-05T15:39:21+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-71901

## From the sources

Improper Control of Resource Identifiers ('Resource Injection') vulnerability in Apache OFBiz.



An authenticate user with access to sfa component can override the service to use on vcard import and access to other service.



This issue affects Apache OFBiz: before 24.09.08.



Users are recommended to upgrade to version 24.09.08, which fixes the issue.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_