CVE-2026-73578None▾ SunlitMissing authorization enforcement in RequestHandler.renderView in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote unauthenticated attacker to bypass the request-map authentication policy for protected views by supplyi…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 2.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Missing authorization enforcement in RequestHandler.renderView in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote unauthenticated attacker to bypass the request-map authentication policy for protected views by supplying a crafted LAST_VIEW_NAME value, which is stored as saved-view state in the anonymous session and later rendered without re-applying the original view's authentication requirement, potentially exposing protected views and associated business data. Users are recommended to upgrade to version 24.09.08, which fixes this issue.
apache_ofbiz < 24.09.08Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-73577NoneApache OFBiz: Unauthenticated path-suffix view authorization bypass
CVE-2026-66903Medium· 6.5Apache OFBiz: Authenticated Path Traversal in Catalog Image Management
CVE-2026-81816NoneApache OFBiz: XML external entity injection (XXE)
CVE-2026-82910High· 8.8Apache OFBiz: renderLink compiles link parameters as FreeMarker source
CVE-2026-82907Critical· 9.8Apache OFBiz: externalLoginKey honoured pre-auth, reusable and unbound
CVE-2026-82912High· 8.8Apache OFBiz: Unsandboxed Groovy compiled from a service parameter