CVE-2026-74841None▾ SunlitIn multitenant deployments, ContextFilter and LoginWorker built a per-tenant delegator name from a request-supplied userTenantId parameter and requested a delegator for it before confirming the tenant existed. DelegatorFactory's internal…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 2.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
In multitenant deployments, ContextFilter and LoginWorker built a per-tenant delegator name from a request-supplied userTenantId parameter and requested a delegator for it before confirming the tenant existed. DelegatorFactory's internal cache retains every delegator name it is asked to resolve, including ones that fail to resolve, so an unauthenticated attacker could submit a stream of arbitrary tenant IDs to grow this cache without bound, driving unnecessary memory and database load.
apache_ofbiz < 24.09.08Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-82904High· 7.5Apache OFBiz: Unbounded multi-form row count from a parameter name
CVE-2026-66903Medium· 6.5Apache OFBiz: Authenticated Path Traversal in Catalog Image Management
CVE-2026-81816NoneApache OFBiz: XML external entity injection (XXE)
CVE-2026-82910High· 8.8Apache OFBiz: renderLink compiles link parameters as FreeMarker source
CVE-2026-82907Critical· 9.8Apache OFBiz: externalLoginKey honoured pre-auth, reusable and unbound
CVE-2026-82912High· 8.8Apache OFBiz: Unsandboxed Groovy compiled from a service parameter