---
id: "CVE-2026-73577"
kind: "vulnerability"
aliases: ["CVE-2026-73577"]
title: "Apache OFBiz: path suffix lets anonymous users bypass view authentication"
severity: "high"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["apache-ofbiz", "java", "package", "self-hosted"]
not_affected_if: ["version-24.09.08-or-later"]
published_at: "2026-11-05T15:17:22+00:00"
first_seen_at: "2026-11-05T15:39:22+00:00"
updated_at: "2026-11-05T15:40:59+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-73577", "first_seen_at": "2026-11-05T15:39:22+00:00"}]
exploit_sources: []
---

# Apache OFBiz: path suffix lets anonymous users bypass view authentication

In Apache OFBiz 24.09 before 24.09.08, appending a protected view to a public request path makes the servlet authorize the request using the public path while rendering the protected view. An unauthenticated remote attacker can therefore reach pages that require login.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed OFBiz version in the release files or build metadata; anything in the `24.09` line below `24.09.08` is exposed.
- Send an unauthenticated request to `/catalog/control/ListLocales/showPortalPage` on your instance and see whether a protected page renders.

## Fix

- Apache OFBiz 24.09 line: upgrade to `24.09.08`

## Timeline

- 2026-11-05T15:39:22+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-73577

## From the sources

Incorrect authorization in RequestHandler in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote unauthenticated attacker to bypass the authentication requirement of a protected view by appending it as a path suffix to a public request (e.g., /catalog/control/ListLocales/showPortalPage), causing the servlet to authorize the request based on the public path component while rendering the protected suffix view. Users are recommended to upgrade to version 24.09.08, which fixes this issue.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_