CVE-2026-82894 · Package
NO FIX YET · SEE WHAT TO DO
Apache OFBiz 24.09 before 24.09.08 lets a remote, unauthenticated attacker make the server invoke arbitrary OFBiz services through the public showHelpPublic page. The attacker can write or delete files on the server and make server-side requests.
first public Nov 5, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
OFBiz 24.09 installations before 24.09.08 that expose the public showHelpPublic view are exposed, on all platforms. The attack needs a Content row whose serviceName was set to an attacker-chosen service by an account with CONTENTMGR_CREATE or CONTENTMGR_UPDATE, so instances where only trusted staff hold those roles carry less risk but are still affected by the missing authorization. Teams on other OFBiz release lines are not covered by this signal.
Not affected if not-24.09, patched-24.09.08
Who cares apache-ofbiz, erp, java, self-hosted
24.09.08showHelpPublic view is reachable from the internet24.09.08Improper Authorization in ContentWorker in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote unauthenticated attacker to trigger arbitrary OFBiz service invocation with attacker-controlled parameters, resulting in arbitrary file write, arbitrary file deletion, and server-side request forgery, by requesting the public showHelpPublic view against a Content row whose serviceName field an account holding only CONTENTMGR_CREATE or CONTENTMGR_UPDATE has set to an attacker-chosen service, causing ContentWorker.renderContentAsText to resolve the service to invoke from that persisted, client-writable field and build its parameters directly from the live HTTP request map with no allow-list, no ownership check, and no requirement that the caller be authenticated. Users are recommended to upgrade to version 24.09.08, which fixes this issue.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.