CVE-2026-73580 · Package
NO FIX YET · SEE WHAT TO DO
A missing authorization check in the getHRChild service of Apache OFBiz lets a remote attacker with no login enumerate HR organization and employee data, including department names, position names, employee party identifiers and organization relationships. The attacker reads this data by sending a crafted partyId parameter.
first public Nov 5, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Organizations running Apache OFBiz through 24.09.07 that expose its HR features to remote users. Exposure depends on whether the getHRChild service is reachable without authentication. Instances not running OFBiz, or running a later release, are not affected.
Not affected if fixed-version, no-internet-exposure
Who cares apache-ofbiz, hr, self-hosted
24.09.07.24.09.08.Missing authorization check in the getHRChild service in Apache OFBiz through 24.09.07 on all platforms allows a remote unauthenticated attacker to recursively enumerate Human Resources organization and employee data, including department names and identifiers, employment position names and identifiers, employee party identifiers, position occupancy, and organization relationships, via a crafted partyId parameter. Users are recommended to upgrade to version 24.09.08, which fixes this issue.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.