CVE-2026-73577 · Package
NO FIX YET · SEE WHAT TO DO
In Apache OFBiz 24.09 before 24.09.08, appending a protected view to a public request path makes the servlet authorize the request using the public path while rendering the protected view. An unauthenticated remote attacker can therefore reach pages that require login.
first public Nov 5, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Teams running Apache OFBiz 24.09 releases earlier than 24.09.08 on any platform with the web application reachable from the internet or an untrusted network. Instances where the public request paths are blocked or fronted by a strict proxy may be less exposed, but the sources do not say how far that limits the flaw.
Not affected if version-24.09.08-or-later
Who cares apache-ofbiz, java, self-hosted
24.09 line below 24.09.08 is exposed./catalog/control/ListLocales/showPortalPage on your instance and see whether a protected page renders.24.09.08Incorrect authorization in RequestHandler in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote unauthenticated attacker to bypass the authentication requirement of a protected view by appending it as a path suffix to a public request (e.g., /catalog/control/ListLocales/showPortalPage), causing the servlet to authorize the request based on the public path component while rendering the protected suffix view. Users are recommended to upgrade to version 24.09.08, which fixes this issue.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.