{"id":"CVE-2026-84728","kind":"vulnerability","aliases":["CVE-2026-84728"],"related":[],"title":"Apache OFBiz: tenant login flaw lets one tenant read and write another's data","description":"Incorrect Authorization in Apache OFBiz \n24.09 before 24.09.08 on all platforms, when documented multitenancy is \nenabled, allows a remote authenticated attacker holding only a valid \nlow-privilege account in one tenant to read and write data belonging to a\n different tenant, by submitting their own tenant's userTenantId \nalongside their own credentials to the normal Party Manager login \nagainst a hostname mapped to a different tenant: ContextFilter resolves \nthe tenant from the hostname via TenantDomainName, but LoginWorker gives\n priority to the conflicting userTenantId request parameter and \nauthenticates against the attacker's own tenant, so a subsequent \nordinary request to the same hostname combines the hostname-mapped \ntenant's Entity Engine delegator with the attacker's tenant's session \ndispatcher, security object, and identity, letting the permission check \nrun against the attacker's own tenant while the resulting read or write \nis performed against the hostname-mapped tenant's data. Users are \nrecommended to upgrade to version 24.09.08, which fixes this issue.","summary":"In Apache OFBiz 24.09 before 24.09.08 with multitenancy enabled, a logged-in user of one tenant can send their own tenant ID at login to act against another tenant's hostname. The permission check runs against the attacker's tenant while reads and writes hit the other tenant's data.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["apache-ofbiz","erp","multitenancy","package"],"not_affected_if":["multitenancy-disabled","single-tenant","version-24.09.08-or-later"],"how_to_check":"- Confirm the OFBiz version in use, e.g. `24.09.x` in the deployed build or release notes.\n- Check whether multitenancy is enabled in the OFBiz configuration (tenant domain names mapped to tenants).","fix":"- Upgrade Apache OFBiz to `24.09.08`.","status":"open","published_at":"2026-11-05T14:17:07+00:00","first_seen_at":"2026-11-05T14:39:19+00:00","triaged_at":"2026-11-05T14:40:33+00:00","updated_at":"2026-11-05T14:40:33+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-05T14:40:33Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Apache OFBiz to `24.09.08`.","reach":"internet","title":"Apache OFBiz: tenant login flaw lets one tenant read and write another's data","impact":"high","summary":"In Apache OFBiz 24.09 before 24.09.08 with multitenancy enabled, a logged-in user of one tenant can send their own tenant ID at login to act against another tenant's hostname. The permission check runs against the attacker's tenant while reads and writes hit the other tenant's data.","audience":"businesses","category":"package","nicknames":[],"who_cares":["apache-ofbiz","multitenancy","erp"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"Authenticated tenant user reads and writes another tenant's data","analyst_note":"","how_to_check":"- Confirm the OFBiz version in use, e.g. `24.09.x` in the deployed build or release notes.\n- Check whether multitenancy is enabled in the OFBiz configuration (tenant domain names mapped to tenants).","plain_action":"","needs_analyst":false,"not_affected_if":["single-tenant","multitenancy-disabled","version-24.09.08-or-later"],"who_is_affected":"Only deployments of Apache OFBiz 24.09 before 24.09.08 with documented multitenancy enabled are exposed. The attacker needs a valid low-privilege account in one tenant, and the flaw works against a hostname mapped to another tenant. Single-tenant installs are not described as affected.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000735,"input_tokens":4502,"output_tokens":570,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':16A,19A '-84728':17A,20A '24.09':30B,83C '24.09.08':32B,85C,237C 'account':106C 'act':53B 'allow':94C 'alongsid':127C 'anoth':12A,55B 'apach':1A,22B,28B,81C 'apache-ofbiz':21B 'attack':65B,98C,168C,193C,210C 'authent':97C,165C 'author':79C 'belong':115C 'check':61B,206C 'combin':181C 'conflict':160C 'contextfilt':145C 'credenti':130C 'cve':15A,18A 'data':14A,77B,114C,229C 'deleg':190C 'differ':118C,143C 'dispatch':198C 'document':90C 'enabl':35B,93C 'engin':189C 'entiti':188C 'erp':24B 'fix':239C 'flaw':5A 'give':156C 'hit':72B 'hold':99C 'hostnam':58B,139C,151C,180C,184C,225C 'hostname-map':183C,224C 'id':49B 'ident':202C 'incorrect':78C 'issu':241C 'let':6A,203C 'log':38B 'logged-in':37B 'login':4A,51B,136C 'loginwork':155C 'low':104C 'low-privileg':103C 'manag':135C 'map':140C,185C,226C 'multiten':25B,34B,91C 'normal':133C 'object':200C 'ofbiz':2A,23B,29B,82C 'one':7A,42B,108C 'ordinari':175C 'packag':26B 'paramet':163C 'parti':134C 'perform':221C 'permiss':60B,205C 'platform':88C 'prioriti':157C 'privileg':105C 'read':9A,69B,111C,217C 'recommend':232C 'remot':96C 'request':162C,176C 'resolv':146C 'result':216C 'run':62B,207C 'secur':199C 'send':45B 'session':197C 'submit':121C 'subsequ':174C 'tenant':3A,8A,43B,48B,56B,67B,75B,109C,119C,124C,144C,148C,171C,186C,195C,213C,227C 'tenantdomainnam':153C 'upgrad':234C 'user':40B,230C 'usertenantid':126C,161C 'valid':102C 'version':236C 'via':152C 'write':11A,71B,113C,219C","nicknames":[],"mitigations":[],"who_affected":"Only deployments of Apache OFBiz 24.09 before 24.09.08 with documented multitenancy enabled are exposed. The attacker needs a valid low-privilege account in one tenant, and the flaw works against a hostname mapped to another tenant. Single-tenant installs are not described as affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["apacheofbiz","erp","high","multitenancy","package"],"campaign_type":null,"first_public_at":"2026-11-05T14:17:07+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-84728","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84728","severity":null,"published_at":"2026-11-05T14:17:07+00:00","modified_at":"2026-11-05T14:17:07+00:00","first_seen_at":"2026-11-05T14:39:19+00:00","fetched_at":"2026-11-05T14:39:19+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}