{"id":"CVE-2026-84183","kind":"vulnerability","aliases":["CVE-2026-84183"],"related":[],"title":"Apache OFBiz: authorization flaw lets low-privilege users run arbitrary commands","description":"Incorrect Authorization in the updateLayout simple-method in applications/content/minilang/layout/LayoutEvents.xml in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote authenticated attacker holding only OFBTOOLS_VIEW and CONTENTMGR_VIEW to execute arbitrary commands as the OFBiz process user, by using updateLayout's authorization check — which validates only the fixed CONTENT_CREATE operation rather than an update permission on the actual Content record and an independently selected DataResource — to relink an existing RESPONSE-purpose Content record and convert an arbitrary, independently selected DataResource into an OFBIZ_FILE/FTL resource pointed at the OFBiz access log, poisoned via a crafted User-Agent header and evaluated through the normal authenticated showContent route. Users are recommended to upgrade to version 24.09.08, which fixes this issue.","summary":"In Apache OFBiz 24.09 before 24.09.08, an authenticated user with only view permissions can relink content records and turn a data resource into a template pointing at the access log. Because a crafted User-Agent header is written into that log and then evaluated as a template, the attacker can execute arbitrary commands as the OFBiz process user.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["apache-ofbiz","java","package","self-hosted"],"not_affected_if":["no-low-privilege-accounts","version-24.09.08-or-later"],"how_to_check":"- Check the OFBiz version in use; `24.09.x` below `24.09.08` is affected.\n- Confirm whether users holding only `OFBTOOLS_VIEW` and `CONTENTMGR_VIEW` can exist in your deployment.","fix":"- Apache OFBiz 24.09: upgrade to `24.09.08`.","status":"open","published_at":"2026-11-05T14:17:06+00:00","first_seen_at":"2026-11-05T14:39:19+00:00","triaged_at":"2026-11-05T14:40:35+00:00","updated_at":"2026-11-05T14:40:35+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-05T14:40:35Z","model":"claude-haiku-5-5","output":{"fix":"- Apache OFBiz 24.09: upgrade to `24.09.08`.","reach":"internet","title":"Apache OFBiz: authorization flaw lets low-privilege users run arbitrary commands","impact":"high","summary":"In Apache OFBiz 24.09 before 24.09.08, an authenticated user with only view permissions can relink content records and turn a data resource into a template pointing at the access log. Because a crafted User-Agent header is written into that log and then evaluated as a template, the attacker can execute arbitrary commands as the OFBiz process user.","audience":"businesses","category":"package","nicknames":[],"who_cares":["apache-ofbiz","self-hosted","java"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"Code runs as the OFBiz process user on the server.","analyst_note":"Confirm the affected range and any workaround beyond upgrading to 24.09.08 from the Apache OFBiz security advisory.","how_to_check":"- Check the OFBiz version in use; `24.09.x` below `24.09.08` is affected.\n- Confirm whether users holding only `OFBTOOLS_VIEW` and `CONTENTMGR_VIEW` can exist in your deployment.","plain_action":"","needs_analyst":true,"not_affected_if":["version-24.09.08-or-later","no-low-privilege-accounts"],"who_is_affected":"Deployments of Apache OFBiz 24.09 before 24.09.08 on any platform are exposed when an authenticated user holds the OFBTOOLS_VIEW and CONTENTMGR_VIEW roles. Attackers need a valid login with those roles, and the flaw is reached through the normal content showContent route. Installations on earlier or later versions, or without those accounts, are not described as affected by the sources.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000778,"input_tokens":4443,"output_tokens":668,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-84183':15A,18A '24.09':30B,99C '24.09.08':32B,101C,205C 'access':55B,180C 'actual':147C 'agent':62B,188C 'allow':105C 'apach':1A,20B,28B,97C 'apache-ofbiz':19B 'applications/content/minilang/layout/layoutevents.xml':95C 'arbitrari':11A,79B,119C,167C 'attack':76B,109C 'authent':34B,108C,195C 'author':3A,87C,130C 'check':131C 'command':12A,80B,120C 'content':42B,137C,148C,162C 'contentmgr':115C 'convert':165C 'craft':59B,185C 'creat':138C 'cve':13A,16A 'data':47B 'dataresourc':154C,170C 'evalu':71B,191C 'execut':78B,118C 'exist':158C 'file/ftl':174C 'fix':136C,207C 'flaw':4A 'header':63B,189C 'hold':110C 'host':26B 'incorrect':86C 'independ':152C,168C 'issu':209C 'java':22B 'let':5A 'log':56B,68B,181C 'low':7A 'low-privileg':6A 'method':93C 'normal':194C 'ofbiz':2A,21B,29B,83B,98C,123C,173C,179C 'ofbtool':112C 'oper':139C 'packag':23B 'permiss':39B,144C 'platform':104C 'point':52B,176C 'poison':182C 'privileg':8A 'process':84B,124C 'purpos':161C 'rather':140C 'recommend':200C 'record':43B,149C,163C 'relink':41B,156C 'remot':107C 'resourc':48B,175C 'respons':160C 'response-purpos':159C 'rout':197C 'run':10A 'select':153C,169C 'self':25B 'self-host':24B 'showcont':196C 'simpl':92C 'simple-method':91C 'templat':51B,74B 'turn':45B 'updat':143C 'updatelayout':90C,128C 'upgrad':202C 'use':127C 'user':9A,35B,61B,85B,125C,187C,198C 'user-ag':60B,186C 'valid':133C 'version':204C 'via':183C 'view':38B,113C,116C 'written':65B","nicknames":[],"mitigations":[],"who_affected":"Deployments of Apache OFBiz 24.09 before 24.09.08 on any platform are exposed when an authenticated user holds the OFBTOOLS_VIEW and CONTENTMGR_VIEW roles. Attackers need a valid login with those roles, and the flaw is reached through the normal content showContent route. Installations on earlier or later versions, or without those accounts, are not described as affected by the sources.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["apacheofbiz","high","java","package","selfhosted"],"campaign_type":null,"first_public_at":"2026-11-05T14:17:06+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-84183","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84183","severity":null,"published_at":"2026-11-05T14:17:06+00:00","modified_at":"2026-11-05T14:17:06+00:00","first_seen_at":"2026-11-05T14:39:19+00:00","fetched_at":"2026-11-05T14:39:19+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}