{"id":"CVE-2026-73577","kind":"vulnerability","aliases":["CVE-2026-73577"],"related":[],"title":"Apache OFBiz: path suffix lets anonymous users bypass view authentication","description":"Incorrect authorization in RequestHandler in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote unauthenticated attacker to bypass the authentication requirement of a protected view by appending it as a path suffix to a public request (e.g., /catalog/control/ListLocales/showPortalPage), causing the servlet to authorize the request based on the public path component while rendering the protected suffix view. Users are recommended to upgrade to version 24.09.08, which fixes this issue.","summary":"In Apache OFBiz 24.09 before 24.09.08, appending a protected view to a public request path makes the servlet authorize the request using the public path while rendering the protected view. An unauthenticated remote attacker can therefore reach pages that require login.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["apache-ofbiz","java","package","self-hosted"],"not_affected_if":["version-24.09.08-or-later"],"how_to_check":"- Check the installed OFBiz version in the release files or build metadata; anything in the `24.09` line below `24.09.08` is exposed.\n- Send an unauthenticated request to `/catalog/control/ListLocales/showPortalPage` on your instance and see whether a protected page renders.","fix":"- Apache OFBiz 24.09 line: upgrade to `24.09.08`","status":"open","published_at":"2026-11-05T15:17:22+00:00","first_seen_at":"2026-11-05T15:39:22+00:00","triaged_at":"2026-11-05T15:40:59+00:00","updated_at":"2026-11-05T15:40:59+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-05T15:40:59Z","model":"claude-haiku-5-5","output":{"fix":"- Apache OFBiz 24.09 line: upgrade to `24.09.08`","reach":"internet","title":"Apache OFBiz: path suffix lets anonymous users bypass view authentication","impact":"medium","summary":"In Apache OFBiz 24.09 before 24.09.08, appending a protected view to a public request path makes the servlet authorize the request using the public path while rendering the protected view. An unauthenticated remote attacker can therefore reach pages that require login.","audience":"businesses","category":"package","nicknames":[],"who_cares":["apache-ofbiz","java","self-hosted"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"Anonymous users read protected views and the data they expose","analyst_note":"Confirm the exact impact of protected views reached via this bypass and whether other paths are affected; check the Apache OFBiz security advisory.","how_to_check":"- Check the installed OFBiz version in the release files or build metadata; anything in the `24.09` line below `24.09.08` is exposed.\n- Send an unauthenticated request to `/catalog/control/ListLocales/showPortalPage` on your instance and see whether a protected page renders.","plain_action":"","needs_analyst":true,"not_affected_if":["version-24.09.08-or-later"],"who_is_affected":"Teams running Apache OFBiz 24.09 releases earlier than 24.09.08 on any platform with the web application reachable from the internet or an untrusted network. Instances where the public request paths are blocked or fronted by a strict proxy may be less exposed, but the sources do not say how far that limits the flaw.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000731,"input_tokens":4297,"output_tokens":602,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-73577':13A,16A '/catalog/control/listlocales/showportalpage':105C '24.09':28B,73C '24.09.08':30B,75C,132C 'allow':79C 'anonym':6A 'apach':1A,18B,26B,71C 'apache-ofbiz':17B 'append':31B,94C 'attack':58B,83C 'authent':10A,87C 'author':43B,67C,110C 'base':113C 'bypass':8A,85C 'caus':106C 'compon':118C 'cve':11A,14A 'e.g':104C 'fix':134C 'host':24B 'incorrect':66C 'issu':136C 'java':20B 'let':5A 'login':65B 'make':40B 'ofbiz':2A,19B,27B,72C 'packag':21B 'page':62B 'path':3A,39B,49B,98C,117C 'platform':78C 'protect':33B,53B,91C,122C 'public':37B,48B,102C,116C 'reach':61B 'recommend':127C 'remot':57B,81C 'render':51B,120C 'request':38B,45B,103C,112C 'requesthandl':69C 'requir':64B,88C 'self':23B 'self-host':22B 'servlet':42B,108C 'suffix':4A,99C,123C 'therefor':60B 'unauthent':56B,82C 'upgrad':129C 'use':46B 'user':7A,125C 'version':131C 'view':9A,34B,54B,92C,124C","nicknames":[],"mitigations":[],"who_affected":"Teams running Apache OFBiz 24.09 releases earlier than 24.09.08 on any platform with the web application reachable from the internet or an untrusted network. Instances where the public request paths are blocked or fronted by a strict proxy may be less exposed, but the sources do not say how far that limits the flaw.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["apacheofbiz","high","java","package","selfhosted"],"campaign_type":null,"first_public_at":"2026-11-05T15:17:22+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-73577","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-73577","severity":null,"published_at":"2026-11-05T15:17:22+00:00","modified_at":"2026-11-05T15:17:22+00:00","first_seen_at":"2026-11-05T15:39:22+00:00","fetched_at":"2026-11-05T15:39:22+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}