---
id: "CVE-2026-83538"
kind: "vulnerability"
aliases: ["CVE-2026-83538"]
title: "Apache OFBiz: missing authorization lets anonymous users read business records"
severity: "high"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "Apache OFBiz", "fixed": ["24.09.08"], "affected": "< 24.09.08", "ecosystem": "vendor"}]
ecosystems: []
tags: ["apache-ofbiz", "erp", "information-disclosure", "package", "self-hosted", "unauthenticated"]
not_affected_if: ["network-restricted-access", "version-24.09.08-or-later"]
published_at: "2026-11-05T14:17:06+00:00"
first_seen_at: "2026-11-05T14:39:19+00:00"
updated_at: "2026-11-05T14:42:42+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-83538", "first_seen_at": "2026-11-05T14:39:19+00:00"}, {"source": "analyst", "url": "https://ofbiz.apache.org/security.html", "first_seen_at": "2026-11-05T14:42:42+00:00", "cites": ["https://ofbiz.apache.org/security.html", "https://seclists.org/oss-sec/2026/q4/516"]}]
exploit_sources: []
---

# Apache OFBiz: missing authorization lets anonymous users read business records

Apache OFBiz 24.09 before 24.09.08 has helper endpoints in the HR, Catalog and Order Manager applications that skip authentication and permission checks. A remote attacker with no account can read organization, employee, product catalog and product-store records.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Apache OFBiz affected < 24.09.08 fixed 24.09.08

## How to check

Find your OFBiz release (the version in your deployment or build, e.g. gradle.properties / release tag). Anything before 24.09.08 is affected per the Apache OFBiz security page. Also check whether the OFBiz web application (HR, Catalog, Order Manager) is reachable from untrusted networks; the project does not list the exact helper endpoints.

## Fix

Upgrade Apache OFBiz to 24.09.08 (fix is PR #1728 per the project's security page). The project names no other workaround.

## Timeline

- 2026-11-05T14:39:19+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-83538
- 2026-11-05T14:42:42+00:00 analyst https://ofbiz.apache.org/security.html — Apache security page lists CVE-2026-83538 as affecting releases before 24.09.08, fixed in 24.09.08 with PR #1728; oss-sec announcement 2026-11-04 titles it unauthenticated disclosure via HR, Catalog, Order Manager helpers. No vendor workaround or endpoint list published; no exploitation or PoC seen (X not checked). NVD page returned nothing. Part of a 46-CVE batch; siblings CVE-2026-73580 (HR disclosure) may overlap.

## Documents

- [advisory] Apache OFBiz Security - list of known vulnerabilities https://ofbiz.apache.org/security.html
- [fix] oss-sec: Apache OFBiz: CVE Announcements (Jacopo Cappellato, 2026-11-04) https://seclists.org/oss-sec/2026/q4/516

## From the sources

Missing Authorization in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote unauthenticated attacker to disclose internal business records — including organization, employee, product catalog, and product-store data — by requesting several helper endpoints across the Human Resources, Catalog, and Order Manager applications that are configured to skip authentication and perform no permission check before returning the requested record. Users are recommended to upgrade to version 24.09.08, which fixes this issue.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_