CVE-2026-73580None▾ SunlitMissing authorization check in the getHRChild service in Apache OFBiz through 24.09.07 on all platforms allows a remote unauthenticated attacker to recursively enumerate Human Resources organization and employee data, including departmen…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 2.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Missing authorization check in the getHRChild service in Apache OFBiz through 24.09.07 on all platforms allows a remote unauthenticated attacker to recursively enumerate Human Resources organization and employee data, including department names and identifiers, employment position names and identifiers, employee party identifiers, position occupancy, and organization relationships, via a crafted partyId parameter. Users are recommended to upgrade to version 24.09.08, which fixes this issue.
apache_ofbiz < 24.09.08Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-83538NoneApache OFBiz: Unauthenticated disclosure through HR, Catalog, and Order Manager helpers
CVE-2026-82916High· 7.1Apache OFBiz: webtools xmldsdump exports any entity to any path
CVE-2026-82902Medium· 4.3Apache OFBiz: Unfiltered server-side URL fetch in webtools viewdatafile
CVE-2026-82904High· 7.5Apache OFBiz: Unbounded multi-form row count from a parameter name
CVE-2026-81734NoneApache OFBiz: Missing authorization - catalog quick-admin product writes
CVE-2026-76152NoneApache OFBiz: Authenticated path traversal and missing authorization check in imageCrop and imageRotate services