CVE-2026-81734 · Package
NO FIX YET · SEE WHAT TO DO
In Apache OFBiz 24.09 before 24.09.08, ProductEvents quick-admin events such as updateProductQuickAdminShipping skip the catalog update permission check. A remote attacker with only catalog view permission can create, modify or remove products, product feature associations and product category associations.
first public Nov 5, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Teams running Apache OFBiz 24.09 before 24.09.08 with authenticated users who hold catalog view permission. The flaw is in the product event handlers, so deployments where only trusted administrators can log in are lower risk. unknown whether other configurations change exposure.
Not affected if no-catalog-view-users, version-24.09.08-or-later
Who cares apache-ofbiz, java, self-hosted
Unknown from the sources.
24.09.08.Missing Authorization in ProductEvents in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote authenticated attacker holding only catalog view permission to create, modify, or remove arbitrary product, product feature association, and product category association data by directly invoking catalog quick-admin events such as updateProductQuickAdminShipping, causing the servlet to authorize the request against the base view-level permission declared on the request-map while the underlying event methods perform entity-engine writes without checking the catalog update/create permission enforced by equivalent sibling event methods in the same class. Users are recommended to upgrade to version 24.09.08, which fixes this issue.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.