CVE-2026-84183 · Package
NO FIX YET · SEE WHAT TO DO
In Apache OFBiz 24.09 before 24.09.08, an authenticated user with only view permissions can relink content records and turn a data resource into a template pointing at the access log. Because a crafted User-Agent header is written into that log and then evaluated as a template, the attacker can execute arbitrary commands as the OFBiz process user.
first public Nov 5, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Deployments of Apache OFBiz 24.09 before 24.09.08 on any platform are exposed when an authenticated user holds the OFBTOOLS_VIEW and CONTENTMGR_VIEW roles. Attackers need a valid login with those roles, and the flaw is reached through the normal content showContent route. Installations on earlier or later versions, or without those accounts, are not described as affected by the sources.
Not affected if no-low-privilege-accounts, version-24.09.08-or-later
Who cares apache-ofbiz, java, self-hosted
24.09.x below 24.09.08 is affected.OFBTOOLS_VIEW and CONTENTMGR_VIEW can exist in your deployment.24.09.08.Incorrect Authorization in the updateLayout simple-method in applications/content/minilang/layout/LayoutEvents.xml in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote authenticated attacker holding only OFBTOOLS_VIEW and CONTENTMGR_VIEW to execute arbitrary commands as the OFBiz process user, by using updateLayout's authorization check — which validates only the fixed CONTENT_CREATE operation rather than an update permission on the actual Content record and an independently selected DataResource — to relink an existing RESPONSE-purpose Content record and convert an arbitrary, independently selected DataResource into an OFBIZ_FILE/FTL resource pointed at the OFBiz access log, poisoned via a crafted User-Agent header and evaluated through the normal authenticated showContent route. Users are recommended to upgrade to version 24.09.08, which fixes this issue.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.