CVE-2026-84183High· 8.8▾ TwilightIncorrect Authorization in the updateLayout simple-method in applications/content/minilang/layout/LayoutEvents.xml in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote authenticated attacker holding only OFBTOOLS_VIEW a…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 48.4 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the CISA ADP record, not NVD.
Incorrect Authorization in the updateLayout simple-method in applications/content/minilang/layout/LayoutEvents.xml in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote authenticated attacker holding only OFBTOOLS_VIEW and CONTENTMGR_VIEW to execute arbitrary commands as the OFBiz process user, by using updateLayout's authorization check — which validates only the fixed CONTENT_CREATE operation rather than an update permission on the actual Content record and an independently selected DataResource — to relink an existing RESPONSE-purpose Content record and convert an arbitrary, independently selected DataResource into an OFBIZ_FILE/FTL resource pointed at the OFBiz access log, poisoned via a crafted User-Agent header and evaluated through the normal authenticated showContent route. Users are recommended to upgrade to version 24.09.08, which fixes this issue.
apache_ofbiz < 24.09.08Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-84728Medium· 5.4Apache OFBiz: Cross-tenant authorization bypass in mapped-domain login
CVE-2026-66903Medium· 6.5Apache OFBiz: Authenticated Path Traversal in Catalog Image Management
CVE-2026-81816NoneApache OFBiz: XML external entity injection (XXE)
CVE-2026-82910High· 8.8Apache OFBiz: renderLink compiles link parameters as FreeMarker source
CVE-2026-82907Critical· 9.8Apache OFBiz: externalLoginKey honoured pre-auth, reusable and unbound
CVE-2026-82912High· 8.8Apache OFBiz: Unsandboxed Groovy compiled from a service parameter