{"id":"CVE-2026-82912","kind":"vulnerability","aliases":["CVE-2026-82912"],"related":[],"title":"Apache OFBiz: email form lets authenticated users run OS commands","description":"Improper Neutralization of Special Elements Used in an Expression Language Statement ('Expression Language Injection') in EmailServices in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote authenticated attacker holding only OFBTOOLS_VIEW and ACCOUNTING_VIEW, the two view-level permissions that open the Accounting application, to execute arbitrary operating system commands as the account running OFBiz, by submitting a ${groovy:...} expression as the bodyText or subject value to the shipped Send Per Email invoice form, because sendMailFromScreen passes those caller-supplied values through FlexibleStringExpander.expandString, which compiles and evaluates embedded Groovy on a class loader that carries none of the SecureASTCustomizer restrictions GroovyUtil.eval applies elsewhere, behind a service and request-map that declare no permission check beyond base authentication. Users are recommended to upgrade to version 24.09.08, which fixes this issue.","summary":"Apache OFBiz 24.09 before 24.09.08 lets a logged-in user with view-level accounting permissions inject a Groovy expression into the bodyText or subject field of the Send Per Email invoice form. The expression is evaluated outside the sandbox that normally restricts Groovy, so the attacker can execute operating system commands as the OFBiz account.","severity":"critical","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["apache-ofbiz","erp","java","package","self-hosted"],"not_affected_if":["managed-hosting","no-accounting-view-users","version-24.09.08-or-later"],"how_to_check":"- Check the installed OFBiz version: `24.09.` releases below `24.09.08` are affected.\n- Confirm whether users with `OFBTOOLS_VIEW` and `ACCOUNTING_VIEW` can reach the Send Per Email invoice form.","fix":"- Apache OFBiz 24.09 series: upgrade to `24.09.08`.","status":"open","published_at":"2026-11-05T14:17:06+00:00","first_seen_at":"2026-11-05T14:39:18+00:00","triaged_at":"2026-11-05T14:40:40+00:00","updated_at":"2026-11-05T14:40:40+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-05T14:40:40Z","model":"claude-haiku-5-5","output":{"fix":"- Apache OFBiz 24.09 series: upgrade to `24.09.08`.","reach":"internet","title":"Apache OFBiz: email form lets authenticated users run OS commands","impact":"high","summary":"Apache OFBiz 24.09 before 24.09.08 lets a logged-in user with view-level accounting permissions inject a Groovy expression into the bodyText or subject field of the Send Per Email invoice form. The expression is evaluated outside the sandbox that normally restricts Groovy, so the attacker can execute operating system commands as the OFBiz account.","audience":"businesses","category":"package","nicknames":[],"who_cares":["apache-ofbiz","java","self-hosted","erp"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"OS commands run as the OFBiz account on the server","analyst_note":"Confirm from NVD or Apache advisory whether the Send Per Email form is reachable by default and whether a CVSS score exists.","how_to_check":"- Check the installed OFBiz version: `24.09.` releases below `24.09.08` are affected.\n- Confirm whether users with `OFBTOOLS_VIEW` and `ACCOUNTING_VIEW` can reach the Send Per Email invoice form.","plain_action":"","needs_analyst":true,"not_affected_if":["version-24.09.08-or-later","no-accounting-view-users","managed-hosting"],"who_is_affected":"Teams running Apache OFBiz 24.09 before 24.09.08 with the Accounting application in use. The exposure requires a logged-in account holding OFBTOOLS_VIEW and ACCOUNTING_VIEW, and reaching the shipped Send Per Email invoice form. Deployments on other OFBiz versions, or where those permissions are not granted to anyone, are not covered by this description.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000787,"input_tokens":4454,"output_tokens":683,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-82912':13A,16A '24.09':28B,102C '24.09.08':30B,104C,213C 'account':41B,82B,118C,129C,139C 'allow':108C 'apach':1A,18B,26B,100C 'apache-ofbiz':17B 'appli':189C 'applic':130C 'arbitrari':133C 'attack':73B,112C 'authent':6A,111C,205C 'base':204C 'behind':191C 'beyond':203C 'bodytext':49B,149C 'caller':166C 'caller-suppli':165C 'carri':182C 'check':202C 'class':179C 'command':10A,78B,136C 'compil':172C 'cve':11A,14A 'declar':199C 'element':87C 'elsewher':190C 'email':3A,57B,158C 'emailservic':98C 'embed':175C 'erp':20B 'evalu':63B,174C 'execut':75B,132C 'express':46B,61B,91C,94C,146C 'field':52B 'fix':215C 'flexiblestringexpander.expandstring':170C 'form':4A,59B,160C 'groovi':45B,70B,145C,176C 'groovyutil.eval':188C 'hold':113C 'host':25B 'improp':83C 'inject':43B,96C 'invoic':58B,159C 'issu':217C 'java':21B 'languag':92C,95C 'let':5A,31B 'level':40B,124C 'loader':180C 'log':34B 'logged-in':33B 'map':197C 'neutral':84C 'none':183C 'normal':68B 'ofbiz':2A,19B,27B,81B,101C,141C 'ofbtool':115C 'open':127C 'oper':76B,134C 'os':9A 'outsid':64B 'packag':22B 'pass':163C 'per':56B,157C 'permiss':42B,125C,201C 'platform':107C 'recommend':208C 'remot':110C 'request':196C 'request-map':195C 'restrict':69B,187C 'run':8A,140C 'sandbox':66B 'secureastcustom':186C 'self':24B 'self-host':23B 'send':55B,156C 'sendmailfromscreen':162C 'servic':193C 'ship':155C 'special':86C 'statement':93C 'subject':51B,151C 'submit':143C 'suppli':167C 'system':77B,135C 'two':121C 'upgrad':210C 'use':88C 'user':7A,36B,206C 'valu':152C,168C 'version':212C 'view':39B,116C,119C,123C 'view-level':38B,122C","nicknames":[],"mitigations":[],"who_affected":"Teams running Apache OFBiz 24.09 before 24.09.08 with the Accounting application in use. The exposure requires a logged-in account holding OFBTOOLS_VIEW and ACCOUNTING_VIEW, and reaching the shipped Send Per Email invoice form. Deployments on other OFBiz versions, or where those permissions are not granted to anyone, are not covered by this description.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["apacheofbiz","critical","erp","java","package","selfhosted"],"campaign_type":null,"first_public_at":"2026-11-05T14:17:06+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-82912","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-82912","severity":null,"published_at":"2026-11-05T14:17:06+00:00","modified_at":"2026-11-05T14:17:06+00:00","first_seen_at":"2026-11-05T14:39:18+00:00","fetched_at":"2026-11-05T14:39:18+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}