---
id: "CVE-2026-82912"
kind: "vulnerability"
aliases: ["CVE-2026-82912"]
title: "Apache OFBiz: email form lets authenticated users run OS commands"
severity: "critical"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["apache-ofbiz", "erp", "java", "package", "self-hosted"]
not_affected_if: ["managed-hosting", "no-accounting-view-users", "version-24.09.08-or-later"]
published_at: "2026-11-05T14:17:06+00:00"
first_seen_at: "2026-11-05T14:39:18+00:00"
updated_at: "2026-11-05T14:40:40+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-82912", "first_seen_at": "2026-11-05T14:39:18+00:00"}]
exploit_sources: []
---

# Apache OFBiz: email form lets authenticated users run OS commands

Apache OFBiz 24.09 before 24.09.08 lets a logged-in user with view-level accounting permissions inject a Groovy expression into the bodyText or subject field of the Send Per Email invoice form. The expression is evaluated outside the sandbox that normally restricts Groovy, so the attacker can execute operating system commands as the OFBiz account.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed OFBiz version: `24.09.` releases below `24.09.08` are affected.
- Confirm whether users with `OFBTOOLS_VIEW` and `ACCOUNTING_VIEW` can reach the Send Per Email invoice form.

## Fix

- Apache OFBiz 24.09 series: upgrade to `24.09.08`.

## Timeline

- 2026-11-05T14:39:18+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-82912

## From the sources

Improper Neutralization of Special Elements Used in an Expression Language Statement ('Expression Language Injection') in EmailServices in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote authenticated attacker holding only OFBTOOLS_VIEW and ACCOUNTING_VIEW, the two view-level permissions that open the Accounting application, to execute arbitrary operating system commands as the account running OFBiz, by submitting a ${groovy:...} expression as the bodyText or subject value to the shipped Send Per Email invoice form, because sendMailFromScreen passes those caller-supplied values through FlexibleStringExpander.expandString, which compiles and evaluates embedded Groovy on a class loader that carries none of the SecureASTCustomizer restrictions GroovyUtil.eval applies elsewhere, behind a service and request-map that declare no permission check beyond base authentication. Users are recommended to upgrade to version 24.09.08, which fixes this issue.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_