{"id":"CVE-2026-82894","kind":"vulnerability","aliases":["CVE-2026-82894"],"related":[],"title":"Apache OFBiz: unauthenticated public page lets attackers write, delete files","description":"Improper Authorization in ContentWorker in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote unauthenticated attacker to trigger arbitrary OFBiz service invocation with attacker-controlled parameters, resulting in arbitrary file write, arbitrary file deletion, and server-side request forgery, by requesting the public showHelpPublic view against a Content row whose serviceName field an account holding only CONTENTMGR_CREATE or CONTENTMGR_UPDATE has set to an attacker-chosen service, causing ContentWorker.renderContentAsText to resolve the service to invoke from that persisted, client-writable field and build its parameters directly from the live HTTP request map with no allow-list, no ownership check, and no requirement that the caller be authenticated. Users are recommended to upgrade to version 24.09.08, which fixes this issue.","summary":"Apache OFBiz 24.09 before 24.09.08 lets a remote, unauthenticated attacker make the server invoke arbitrary OFBiz services through the public showHelpPublic page. The attacker can write or delete files on the server and make server-side requests.","severity":"critical","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["apache-ofbiz","erp","java","package","self-hosted"],"not_affected_if":["not-24.09","patched-24.09.08"],"how_to_check":"- Check the installed OFBiz version in the deployment or the build files; affected versions are 24.09 before `24.09.08`\n- Confirm whether the `showHelpPublic` view is reachable from the internet\n- Review Content rows whose serviceName field was set by accounts holding CONTENTMGR_CREATE or CONTENTMGR_UPDATE","fix":"- Apache OFBiz: upgrade to `24.09.08`","status":"open","published_at":"2026-11-05T15:17:26+00:00","first_seen_at":"2026-11-05T15:39:22+00:00","triaged_at":"2026-11-05T15:40:46+00:00","updated_at":"2026-11-05T15:40:46+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-05T15:40:46Z","model":"claude-haiku-5-5","output":{"fix":"- Apache OFBiz: upgrade to `24.09.08`","reach":"internet","title":"Apache OFBiz: unauthenticated public page lets attackers write, delete files","impact":"high","summary":"Apache OFBiz 24.09 before 24.09.08 lets a remote, unauthenticated attacker make the server invoke arbitrary OFBiz services through the public showHelpPublic page. The attacker can write or delete files on the server and make server-side requests.","audience":"businesses","category":"package","nicknames":[],"who_cares":["apache-ofbiz","java","self-hosted","erp"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"Remote attacker writes or deletes server files and reaches internal URLs","analyst_note":"Confirm the affected version range against the Apache OFBiz security advisory and whether other release lines are affected; sources only give 24.09 before 24.09.08.","how_to_check":"- Check the installed OFBiz version in the deployment or the build files; affected versions are 24.09 before `24.09.08`\n- Confirm whether the `showHelpPublic` view is reachable from the internet\n- Review Content rows whose serviceName field was set by accounts holding CONTENTMGR_CREATE or CONTENTMGR_UPDATE","plain_action":"","needs_analyst":true,"not_affected_if":["not-24.09","patched-24.09.08"],"who_is_affected":"OFBiz 24.09 installations before 24.09.08 that expose the public showHelpPublic view are exposed, on all platforms. The attack needs a Content row whose serviceName was set to an attacker-chosen service by an account with CONTENTMGR_CREATE or CONTENTMGR_UPDATE, so instances where only trusted staff hold those roles carry less risk but are still affected by the missing authorization. Teams on other OFBiz release lines are not covered by this signal.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000794,"input_tokens":4425,"output_tokens":703,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-82894':13A,16A '24.09':28B,71C '24.09.08':30B,73C,186C 'account':121C 'allow':77C,166C 'allow-list':165C 'apach':1A,18B,26B,69C 'apache-ofbiz':17B 'arbitrari':40B,84C,95C,98C 'attack':7A,35B,49B,81C,90C,134C 'attacker-chosen':133C 'attacker-control':89C 'authent':178C 'author':65C 'build':153C 'caller':176C 'caus':137C 'check':170C 'chosen':135C 'client':149C 'client-writ':148C 'content':115C 'contentmgr':124C,127C 'contentwork':67C 'contentworker.rendercontentastext':138C 'control':91C 'creat':125C 'cve':11A,14A 'delet':9A,53B,100C 'direct':156C 'erp':20B 'field':119C,151C 'file':10A,54B,96C,99C 'fix':188C 'forgeri':106C 'hold':122C 'host':25B 'http':160C 'improp':64C 'invoc':87C 'invok':39B,144C 'issu':190C 'java':21B 'let':6A,31B 'list':167C 'live':159C 'make':36B,59B 'map':162C 'ofbiz':2A,19B,27B,41B,70C,85C 'ownership':169C 'packag':22B 'page':5A,47B 'paramet':92C,155C 'persist':147C 'platform':76C 'public':4A,45B,110C 'recommend':181C 'remot':33B,79C 'request':63B,105C,108C,161C 'requir':173C 'resolv':140C 'result':93C 'row':116C 'self':24B 'self-host':23B 'server':38B,57B,61B,103C 'server-sid':60B,102C 'servic':42B,86C,136C,142C 'servicenam':118C 'set':130C 'showhelppubl':46B,111C 'side':62B,104C 'trigger':83C 'unauthent':3A,34B,80C 'updat':128C 'upgrad':183C 'user':179C 'version':185C 'view':112C 'whose':117C 'writabl':150C 'write':8A,51B,97C","nicknames":[],"mitigations":[],"who_affected":"OFBiz 24.09 installations before 24.09.08 that expose the public showHelpPublic view are exposed, on all platforms. The attack needs a Content row whose serviceName was set to an attacker-chosen service by an account with CONTENTMGR_CREATE or CONTENTMGR_UPDATE, so instances where only trusted staff hold those roles carry less risk but are still affected by the missing authorization. Teams on other OFBiz release lines are not covered by this signal.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["apacheofbiz","critical","erp","java","package","selfhosted"],"campaign_type":null,"first_public_at":"2026-11-05T15:17:26+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-82894","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-82894","severity":null,"published_at":"2026-11-05T15:17:26+00:00","modified_at":"2026-11-05T15:17:26+00:00","first_seen_at":"2026-11-05T15:39:22+00:00","fetched_at":"2026-11-05T15:39:22+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}