CVE-2026-81744 · Package
NO FIX YET · SEE WHAT TO DO
In Apache OFBiz 24.09 before 24.09.08, a user with only a limited content-create permission can call the createContentRole service to give themselves the OWNER role on arbitrary content. A fail-open default in the permission check then lets that self-granted role pass ownership checks, giving full read, write and delete control over content they should not reach.
first public Nov 5, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Organizations running Apache OFBiz 24.09 releases before 24.09.08 on any platform, where users hold content-create permissions. The flaw needs an authenticated account with that limited permission, so deployments with no self-service content creation or only trusted staff accounts are at lower exposure. Public-facing instances with user registration carry more risk. Details beyond the NVD description were not provided, so the exact exposed configurations are unknown.
Not affected if no-content-create-users, version-24.09.08-or-later
Who cares apache-ofbiz, java, self-hosted
24.09. versions below 24.09.08 are affected.24.09.08 or later (the sources state this version fixes the issue).Incorrect Authorization in ContentPermissionServices in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote authenticated attacker holding only a limited content-create permission to self-grant the OWNER role on arbitrary content by invoking the createContentRole service (e.g. via the createForumGroupRole request), causing the permission check to fall through to a fail-open default-grant branch when no ContentPurposeOperation entry matches the requested operation and content purpose, rather than denying the request. A self-granted OWNER role then satisfies the ownership check used to authorize update, removal, and status changes on that content, giving the attacker full read/write/delete control over content they should not have access to. Users are recommended to upgrade to version 24.09.08, which fixes this issue.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.