{"id":"CVE-2026-81808","kind":"vulnerability","aliases":["CVE-2026-81808"],"related":[],"title":"Apache OFBiz: catalog viewers can bulk-edit product categories and features","description":"Missing Authorization in ProductSearchEvents in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote authenticated attacker holding only catalog view permission to bulk-modify product category and feature associations across arbitrary search results by seeding a broad product search and then invoking search-result mutation events such as searchRemoveFromCategory, searchExpireFromCategory, searchAddToCategory, searchAddFeature, and searchRemoveFeature, causing the servlet to authorize the request against only the base view-level permission declared on the request-map while the underlying event methods perform bulk entity-engine deletes/inserts without checking the DELETE/CREATE permission enforced by the equivalent service-layer operations (e.g. removeProductFromCategory). Users are recommended to upgrade to version 24.09.08, which fixes this issue.","summary":"Apache OFBiz 24.09 before 24.09.08 checks only view permission on product search mutation events, so a logged-in user with catalog view rights can bulk-add, remove or expire product category and feature links. The sources do not describe code execution or data theft beyond altering catalog associations.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["apache-ofbiz","ecommerce","package","self-hosted"],"not_affected_if":["no-catalog-view-users","version-not-24.09"],"how_to_check":null,"fix":"- Apache OFBiz: upgrade to `24.09.08`","status":"open","published_at":"2026-11-05T15:17:26+00:00","first_seen_at":"2026-11-05T15:39:22+00:00","triaged_at":"2026-11-05T15:40:50+00:00","updated_at":"2026-11-05T15:40:50+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-05T15:40:50Z","model":"claude-haiku-5-5","output":{"fix":"- Apache OFBiz: upgrade to `24.09.08`","reach":"internet","title":"Apache OFBiz: catalog viewers can bulk-edit product categories and features","impact":"medium","summary":"Apache OFBiz 24.09 before 24.09.08 checks only view permission on product search mutation events, so a logged-in user with catalog view rights can bulk-add, remove or expire product category and feature links. The sources do not describe code execution or data theft beyond altering catalog associations.","audience":"businesses","category":"package","nicknames":[],"who_cares":["apache-ofbiz","self-hosted","ecommerce"],"confidence":0.6,"fix_status":"available","needs_auth":"yes","worst_case":"authenticated user alters product category and feature associations in bulk","analyst_note":"","how_to_check":"- Check the OFBiz version in use; `24.09.00` through `24.09.07` are affected\n- Confirm whether product search and catalog editing are reachable by users with view-only catalog permission","plain_action":"","needs_analyst":false,"not_affected_if":["version-not-24.09","no-catalog-view-users"],"who_is_affected":"Deployments of Apache OFBiz 24.09 before 24.09.08 that give accounts catalog view permission. The flaw is in the ProductSearchEvents servlet path, so installations where those accounts are not present or where product search is not exposed to them are less exposed. Teams not running OFBiz 24.09 can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000717,"input_tokens":4417,"output_tokens":551,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-81808':15A,18A '24.09':29B,84C '24.09.08':31B,86C,189C 'across':109C 'add':54B 'allow':90C 'alter':74B 'apach':1A,20B,27B,82C 'apache-ofbiz':19B 'arbitrari':110C 'associ':76B,108C 'attack':94C 'authent':93C 'author':78C,139C 'base':145C 'beyond':73B 'broad':116C 'bulk':7A,53B,102C,162C 'bulk-add':52B 'bulk-edit':6A 'bulk-modifi':101C 'catalog':3A,48B,75B,97C 'categori':10A,59B,105C 'caus':135C 'check':32B,168C 'code':68B 'cve':13A,16A 'data':71B 'declar':150C 'delete/create':170C 'deletes/inserts':166C 'describ':67B 'e.g':180C 'ecommerc':22B 'edit':8A 'enforc':172C 'engin':165C 'entiti':164C 'entity-engin':163C 'equival':175C 'event':40B,126C,159C 'execut':69B 'expir':57B 'featur':12A,61B,107C 'fix':191C 'hold':95C 'host':26B 'invok':121C 'issu':193C 'layer':178C 'level':148C 'link':62B 'log':44B 'logged-in':43B 'map':155C 'method':160C 'miss':77C 'modifi':103C 'mutat':39B,125C 'ofbiz':2A,21B,28B,83C 'oper':179C 'packag':23B 'perform':161C 'permiss':35B,99C,149C,171C 'platform':89C 'product':9A,37B,58B,104C,117C 'productsearchev':80C 'recommend':184C 'remot':92C 'remov':55B 'removeproductfromcategori':181C 'request':141C,154C 'request-map':153C 'result':112C,124C 'right':50B 'search':38B,111C,118C,123C 'search-result':122C 'searchaddfeatur':132C 'searchaddtocategori':131C 'searchexpirefromcategori':130C 'searchremovefeatur':134C 'searchremovefromcategori':129C 'seed':114C 'self':25B 'self-host':24B 'servic':177C 'service-lay':176C 'servlet':137C 'sourc':64B 'theft':72B 'under':158C 'upgrad':186C 'user':46B,182C 'version':188C 'view':34B,49B,98C,147C 'view-level':146C 'viewer':4A 'without':167C","nicknames":[],"mitigations":[],"who_affected":"Deployments of Apache OFBiz 24.09 before 24.09.08 that give accounts catalog view permission. The flaw is in the ProductSearchEvents servlet path, so installations where those accounts are not present or where product search is not exposed to them are less exposed. Teams not running OFBiz 24.09 can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["apacheofbiz","ecommerce","medium","package","selfhosted"],"campaign_type":null,"first_public_at":"2026-11-05T15:17:26+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-81808","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-81808","severity":null,"published_at":"2026-11-05T15:17:26+00:00","modified_at":"2026-11-05T15:17:26+00:00","first_seen_at":"2026-11-05T15:39:22+00:00","fetched_at":"2026-11-05T15:39:22+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}