---
id: "CVE-2026-84728"
kind: "vulnerability"
aliases: ["CVE-2026-84728"]
title: "Apache OFBiz: tenant login flaw lets one tenant read and write another's data"
severity: "high"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["apache-ofbiz", "erp", "multitenancy", "package"]
not_affected_if: ["multitenancy-disabled", "single-tenant", "version-24.09.08-or-later"]
published_at: "2026-11-05T14:17:07+00:00"
first_seen_at: "2026-11-05T14:39:19+00:00"
updated_at: "2026-11-05T14:40:33+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-84728", "first_seen_at": "2026-11-05T14:39:19+00:00"}]
exploit_sources: []
---

# Apache OFBiz: tenant login flaw lets one tenant read and write another's data

In Apache OFBiz 24.09 before 24.09.08 with multitenancy enabled, a logged-in user of one tenant can send their own tenant ID at login to act against another tenant's hostname. The permission check runs against the attacker's tenant while reads and writes hit the other tenant's data.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Confirm the OFBiz version in use, e.g. `24.09.x` in the deployed build or release notes.
- Check whether multitenancy is enabled in the OFBiz configuration (tenant domain names mapped to tenants).

## Fix

- Upgrade Apache OFBiz to `24.09.08`.

## Timeline

- 2026-11-05T14:39:19+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-84728

## From the sources

Incorrect Authorization in Apache OFBiz 
24.09 before 24.09.08 on all platforms, when documented multitenancy is 
enabled, allows a remote authenticated attacker holding only a valid 
low-privilege account in one tenant to read and write data belonging to a
 different tenant, by submitting their own tenant's userTenantId 
alongside their own credentials to the normal Party Manager login 
against a hostname mapped to a different tenant: ContextFilter resolves 
the tenant from the hostname via TenantDomainName, but LoginWorker gives
 priority to the conflicting userTenantId request parameter and 
authenticates against the attacker's own tenant, so a subsequent 
ordinary request to the same hostname combines the hostname-mapped 
tenant's Entity Engine delegator with the attacker's tenant's session 
dispatcher, security object, and identity, letting the permission check 
run against the attacker's own tenant while the resulting read or write 
is performed against the hostname-mapped tenant's data. Users are 
recommended to upgrade to version 24.09.08, which fixes this issue.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_