CVE-2026-81808 · Package
NO FIX YET · SEE WHAT TO DO
Apache OFBiz 24.09 before 24.09.08 checks only view permission on product search mutation events, so a logged-in user with catalog view rights can bulk-add, remove or expire product category and feature links. The sources do not describe code execution or data theft beyond altering catalog associations.
first public Nov 5, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Deployments of Apache OFBiz 24.09 before 24.09.08 that give accounts catalog view permission. The flaw is in the ProductSearchEvents servlet path, so installations where those accounts are not present or where product search is not exposed to them are less exposed. Teams not running OFBiz 24.09 can skip it.
Not affected if no-catalog-view-users, version-not-24.09
Who cares apache-ofbiz, ecommerce, self-hosted
Unknown from the sources.
24.09.08Missing Authorization in ProductSearchEvents in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote authenticated attacker holding only catalog view permission to bulk-modify product category and feature associations across arbitrary search results by seeding a broad product search and then invoking search-result mutation events such as searchRemoveFromCategory, searchExpireFromCategory, searchAddToCategory, searchAddFeature, and searchRemoveFeature, causing the servlet to authorize the request against only the base view-level permission declared on the request-map while the underlying event methods perform bulk entity-engine deletes/inserts without checking the DELETE/CREATE permission enforced by the equivalent service-layer operations (e.g. removeProductFromCategory). Users are recommended to upgrade to version 24.09.08, which fixes this issue.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.