---
id: CVE-2026-71901
title: 'Apache OFBiz: Dispatch arbitrary internal services on SFA component'
summary: >-
  Improper Control of Resource Identifiers ('Resource Injection') vulnerability
  in Apache OFBiz.




  An authenticate user with access to sfa component can override the service to
  use on vcard import and access to other service.




  This issu…
severity: high
cvss: 8.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N'
cvssSource: adp
cwe:
  - CWE-99
vendor: Apache Software Foundation
product: Apache OFBiz
affected:
  - apache_ofbiz < 24.09.08
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-11-05T21:36:35.745579Z'
published: '2026-11-05'
updated: '2026-11-05'
sourceUpdated: '2026-11-05T21:36:42.194Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-71901'
references:
  - url: 'https://lists.apache.org/thread.html/7b2syzksp7klt9fvhdg0olldvs2g83lz'
tags:
  - cve.org
ingestedAt: '2026-11-05T21:36:00.870Z'
---

## Overview

Improper Control of Resource Identifiers ('Resource Injection') vulnerability in Apache OFBiz.



An authenticate user with access to sfa component can override the service to use on vcard import and access to other service.



This issue affects Apache OFBiz: before 24.09.08.



Users are recommended to upgrade to version 24.09.08, which fixes the issue.

## Affected

- `apache_ofbiz < 24.09.08`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.