{"id":"CVE-2026-81744","kind":"vulnerability","aliases":["CVE-2026-81744"],"related":[],"title":"Apache OFBiz: authenticated users can self-grant content ownership and edit anything","description":"Incorrect Authorization in ContentPermissionServices in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote authenticated attacker holding only a limited content-create permission to self-grant the OWNER role on arbitrary content by invoking the createContentRole service (e.g. via the createForumGroupRole request), causing the permission check to fall through to a fail-open default-grant branch when no ContentPurposeOperation entry matches the requested operation and content purpose, rather than denying the request. A self-granted OWNER role then satisfies the ownership check used to authorize update, removal, and status changes on that content, giving the attacker full read/write/delete control over content they should not have access to. Users are recommended to upgrade to version 24.09.08, which fixes this issue.","summary":"In Apache OFBiz 24.09 before 24.09.08, a user with only a limited content-create permission can call the createContentRole service to give themselves the OWNER role on arbitrary content. A fail-open default in the permission check then lets that self-granted role pass ownership checks, giving full read, write and delete control over content they should not reach.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["apache-ofbiz","java","package","self-hosted"],"not_affected_if":["no-content-create-users","version-24.09.08-or-later"],"how_to_check":"- Check the installed OFBiz version in the framework's version files or release package; `24.09.` versions below `24.09.08` are affected.\n- Review who holds content-create permissions and whether untrusted or low-privilege accounts can reach the forum group and content role request paths.","fix":"- Apache OFBiz `24.09.08` or later (the sources state this version fixes the issue).","status":"open","published_at":"2026-11-05T15:17:26+00:00","first_seen_at":"2026-11-05T15:39:22+00:00","triaged_at":"2026-11-05T15:40:54+00:00","updated_at":"2026-11-05T15:40:54+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-05T15:40:54Z","model":"claude-haiku-5-5","output":{"fix":"- Apache OFBiz `24.09.08` or later (the sources state this version fixes the issue).","reach":"network","title":"Apache OFBiz: authenticated users can self-grant content ownership and edit anything","impact":"high","summary":"In Apache OFBiz 24.09 before 24.09.08, a user with only a limited content-create permission can call the createContentRole service to give themselves the OWNER role on arbitrary content. A fail-open default in the permission check then lets that self-granted role pass ownership checks, giving full read, write and delete control over content they should not reach.","audience":"businesses","category":"package","nicknames":[],"who_cares":["apache-ofbiz","self-hosted","java"],"confidence":0.6,"fix_status":"available","needs_auth":"yes","worst_case":"Attacker reads, edits and deletes content they should not access","analyst_note":"Confirm the affected version range and whether default OFBiz configurations expose the createForumGroupRole path to limited users, using the Apache OFBiz security advisory.","how_to_check":"- Check the installed OFBiz version in the framework's version files or release package; `24.09.` versions below `24.09.08` are affected.\n- Review who holds content-create permissions and whether untrusted or low-privilege accounts can reach the forum group and content role request paths.","plain_action":"","needs_analyst":true,"not_affected_if":["version-24.09.08-or-later","no-content-create-users"],"who_is_affected":"Organizations running Apache OFBiz 24.09 releases before 24.09.08 on any platform, where users hold content-create permissions. The flaw needs an authenticated account with that limited permission, so deployments with no self-service content creation or only trusted staff accounts are at lower exposure. Public-facing instances with user registration carry more risk. Details beyond the NVD description were not provided, so the exact exposed configurations are unknown.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.00078,"input_tokens":4391,"output_tokens":682,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':15A,18A '-81744':16A,19A '24.09':31B,97C '24.09.08':33B,99C,211C 'access':202C 'allow':103C 'anyth':13A 'apach':1A,21B,29B,95C 'apache-ofbiz':20B 'arbitrari':56B,124C 'attack':107C,192C 'authent':3A,106C 'author':91C,181C 'branch':151C 'call':45B 'caus':136C 'chang':186C 'check':66B,76B,139C,178C 'content':9A,41B,57B,85B,113C,125C,161C,189C,197C 'content-cr':40B,112C 'contentpermissionservic':93C 'contentpurposeoper':154C 'control':83B,195C 'creat':42B,114C 'createcontentrol':47B,129C 'createforumgrouprol':134C 'cve':14A,17A 'default':62B,149C 'default-gr':148C 'delet':82B 'deni':165C 'e.g':131C 'edit':12A 'entri':155C 'fail':60B,146C 'fail-open':59B,145C 'fall':141C 'fix':213C 'full':78B,193C 'give':50B,77B,190C 'grant':8A,72B,119C,150C,171C 'hold':108C 'host':27B 'incorrect':90C 'invok':127C 'issu':215C 'java':23B 'let':68B 'limit':39B,111C 'match':156C 'ofbiz':2A,22B,30B,96C 'open':61B,147C 'oper':159C 'owner':53B,121C,172C 'ownership':10A,75B,177C 'packag':24B 'pass':74B 'permiss':43B,65B,115C,138C 'platform':102C 'purpos':162C 'rather':163C 'reach':89B 'read':79B 'read/write/delete':194C 'recommend':206C 'remot':105C 'remov':183C 'request':135C,158C,167C 'role':54B,73B,122C,173C 'satisfi':175C 'self':7A,26B,71B,118C,170C 'self-grant':6A,70B,117C,169C 'self-host':25B 'servic':48B,130C 'status':185C 'updat':182C 'upgrad':208C 'use':179C 'user':4A,35B,204C 'version':210C 'via':132C 'write':80B","nicknames":[],"mitigations":[],"who_affected":"Organizations running Apache OFBiz 24.09 releases before 24.09.08 on any platform, where users hold content-create permissions. The flaw needs an authenticated account with that limited permission, so deployments with no self-service content creation or only trusted staff accounts are at lower exposure. Public-facing instances with user registration carry more risk. Details beyond the NVD description were not provided, so the exact exposed configurations are unknown.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["apacheofbiz","high","java","package","selfhosted"],"campaign_type":null,"first_public_at":"2026-11-05T15:17:26+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-81744","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-81744","severity":null,"published_at":"2026-11-05T15:17:26+00:00","modified_at":"2026-11-05T15:17:26+00:00","first_seen_at":"2026-11-05T15:39:22+00:00","fetched_at":"2026-11-05T15:39:22+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}