{"id":"CVE-2026-83538","kind":"vulnerability","aliases":["CVE-2026-83538"],"related":[],"title":"Apache OFBiz: missing authorization lets anonymous users read business records","description":"Missing Authorization in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote unauthenticated attacker to disclose internal business records — including organization, employee, product catalog, and product-store data — by requesting several helper endpoints across the Human Resources, Catalog, and Order Manager applications that are configured to skip authentication and perform no permission check before returning the requested record. Users are recommended to upgrade to version 24.09.08, which fixes this issue.","summary":"Apache OFBiz 24.09 before 24.09.08 has helper endpoints in the HR, Catalog and Order Manager applications that skip authentication and permission checks. A remote attacker with no account can read organization, employee, product catalog and product-store records.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Apache OFBiz","fixed":["24.09.08"],"affected":"< 24.09.08","ecosystem":"vendor"}],"ecosystems":[],"tags":["apache-ofbiz","erp","information-disclosure","package","self-hosted","unauthenticated"],"not_affected_if":["network-restricted-access","version-24.09.08-or-later"],"how_to_check":"Find your OFBiz release (the version in your deployment or build, e.g. gradle.properties / release tag). Anything before 24.09.08 is affected per the Apache OFBiz security page. Also check whether the OFBiz web application (HR, Catalog, Order Manager) is reachable from untrusted networks; the project does not list the exact helper endpoints.","fix":"Upgrade Apache OFBiz to 24.09.08 (fix is PR #1728 per the project's security page). The project names no other workaround.","status":"open","published_at":"2026-11-05T14:17:06+00:00","first_seen_at":"2026-11-05T14:39:19+00:00","triaged_at":"2026-11-05T14:40:38+00:00","updated_at":"2026-11-05T14:42:42+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-05T14:40:38Z","model":"claude-haiku-5-5","output":{"fix":"- Apache OFBiz: upgrade to `24.09.08`.","reach":"internet","title":"Apache OFBiz: missing authorization lets anonymous users read business records","impact":"medium","summary":"Apache OFBiz 24.09 before 24.09.08 has helper endpoints in the HR, Catalog and Order Manager applications that skip authentication and permission checks. A remote attacker with no account can read organization, employee, product catalog and product-store records.","audience":"businesses","category":"package","nicknames":[],"who_cares":["apache-ofbiz","erp","self-hosted"],"confidence":0.6,"fix_status":"available","needs_auth":"no","worst_case":"Anonymous attackers read employee and business records from the system.","analyst_note":"Check the NVD entry and the Apache OFBiz security advisory for the list of affected endpoints and any workaround beyond upgrading.","how_to_check":"- Check the installed OFBiz version in the project's build or release files: `24.09.00` through `24.09.07` are affected.\n- Confirm whether the HR, Catalog or Order Manager applications are deployed and reachable from the internet.","plain_action":"","needs_analyst":true,"not_affected_if":["version-24.09.08-or-later","network-restricted-access"],"who_is_affected":"Teams running Apache OFBiz 24.09 before 24.09.08 on any platform, especially where the HR, Catalog or Order Manager applications are reachable over the network. The sources describe the flaw as affecting helper endpoints configured to skip authentication, so deployments that restrict access at a proxy or network layer are less exposed, but the sources do not confirm which configurations are safe.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000737,"input_tokens":4286,"output_tokens":616,"severity_before":"unknown"},"analyst_status":"done","analyst_note":"Check the NVD entry and the Apache OFBiz security advisory for the list of affected endpoints and any workaround beyond upgrading.","search":"'-2026':12A,15A '-83538':13A,16A '24.09':33B,75C '24.09.08':35B,77C,138C 'account':58B 'across':106C 'allow':81C 'anonym':6A 'apach':1A,20B,31B,73C 'apache':17A 'apache-ofbiz':19B 'applic':46B,114C 'attack':55B,85C 'authent':49B,120C 'author':4A,71C 'busi':9A,89C 'catalog':42B,64B,95C,110C 'check':52B,125C 'configur':117C 'cve':11A,14A 'data':100C 'disclos':87C 'disclosur':25B 'employe':62B,93C 'endpoint':38B,105C 'erp':22B 'fix':140C 'helper':37B,104C 'host':29B 'hr':41B 'human':108C 'includ':91C 'inform':24B 'information-disclosur':23B 'intern':88C 'issu':142C 'let':5A 'manag':45B,113C 'miss':3A,70C 'ofbiz':2A,18A,21B,32B,74C 'order':44B,112C 'organ':61B,92C 'packag':26B 'perform':122C 'permiss':51B,124C 'platform':80C 'product':63B,67B,94C,98C 'product-stor':66B,97C 'read':8A,60B 'recommend':133C 'record':10A,69B,90C,130C 'remot':54B,83C 'request':102C,129C 'resourc':109C 'return':127C 'self':28B 'self-host':27B 'sever':103C 'skip':48B,119C 'store':68B,99C 'unauthent':30B,84C 'upgrad':135C 'user':7A,131C 'version':137C","nicknames":[],"mitigations":[],"who_affected":"Anyone running a self-hosted Apache OFBiz release before 24.09.08 with the web application reachable by untrusted users. The Apache announcement calls it unauthenticated disclosure through HR, Catalog and Order Manager helpers, so organization, employee, catalog and order-related data may be readable without an account. Instances reachable only on a private network are at lower risk, and 24.09.08 or later can skip it.","tier":"B","verified":{"fix":{"at":"2026-11-05T14:42:42Z","by":"analyst","doc":"https://seclists.org/oss-sec/2026/q4/516","run_id":1786},"products":{"at":"2026-11-05T14:42:42Z","by":"analyst","doc":"https://seclists.org/oss-sec/2026/q4/516","run_id":1786}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["apacheofbiz","ofbiz"],"ptokens":["apache","ofbiz"],"labels":["apacheofbiz","erp","high","informationdisclosure","package","selfhosted","unauthenticated"],"campaign_type":null,"first_public_at":"2026-11-05T14:17:06+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-83538","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83538","severity":null,"published_at":"2026-11-05T14:17:06+00:00","modified_at":"2026-11-05T14:17:06+00:00","first_seen_at":"2026-11-05T14:39:19+00:00","fetched_at":"2026-11-05T14:39:19+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-83538:1786","url":"https://ofbiz.apache.org/security.html","severity":null,"published_at":"2026-11-05T14:42:42+00:00","modified_at":"2026-11-05T14:42:42+00:00","first_seen_at":"2026-11-05T14:42:42+00:00","fetched_at":"2026-11-05T14:42:42+00:00","note":"Apache security page lists CVE-2026-83538 as affecting releases before 24.09.08, fixed in 24.09.08 with PR #1728; oss-sec announcement 2026-11-04 titles it unauthenticated disclosure via HR, Catalog, Order Manager helpers. No vendor workaround or endpoint list published; no exploitation or PoC seen (X not checked). NVD page returned nothing. Part of a 46-CVE batch; siblings CVE-2026-73580 (HR disclosure) may overlap.","cites":["https://ofbiz.apache.org/security.html","https://seclists.org/oss-sec/2026/q4/516"]}],"documents":[{"id":76985,"url":"https://ofbiz.apache.org/security.html","title":"Apache OFBiz Security - list of known vulnerabilities","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":76997,"url":"https://seclists.org/oss-sec/2026/q4/516","title":"oss-sec: Apache OFBiz: CVE Announcements (Jacopo Cappellato, 2026-11-04)","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}