APACHE OFBIZ · CVE-2026-83538 · Package
FIX → 24.09.08 ✓ verified
Apache OFBiz 24.09 before 24.09.08 has helper endpoints in the HR, Catalog and Order Manager applications that skip authentication and permission checks. A remote attacker with no account can read organization, employee, product catalog and product-store records.
first public Nov 5, 2026 · 2 sources
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Anyone running a self-hosted Apache OFBiz release before 24.09.08 with the web application reachable by untrusted users. The Apache announcement calls it unauthenticated disclosure through HR, Catalog and Order Manager helpers, so organization, employee, catalog and order-related data may be readable without an account. Instances reachable only on a private network are at lower risk, and 24.09.08 or later can skip it.
Not affected if network-restricted-access, version-24.09.08-or-later
Who cares apache-ofbiz, erp, information-disclosure, self-hosted, unauthenticated
24.09.08 is affected per the Apache OFBiz security pageUpgrade to 24.09.08
Missing Authorization in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote unauthenticated attacker to disclose internal business records — including organization, employee, product catalog, and product-store data — by requesting several helper endpoints across the Human Resources, Catalog, and Order Manager applications that are configured to skip authentication and perform no permission check before returning the requested record. Users are recommended to upgrade to version 24.09.08, which fixes this issue.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
24.09.08 (fix is PR #1728 per the project's security page)