---
id: CVE-2026-84728
title: 'Apache OFBiz: Cross-tenant authorization bypass in mapped-domain login'
summary: |-
  Incorrect Authorization in Apache OFBiz 
  24.09 before 24.09.08 on all platforms, when documented multitenancy is 
  enabled, allows a remote authenticated attacker holding only a valid 
  low-privilege account in one tenant to read and write…
severity: medium
cvss: 5.4
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N'
cvssSource: adp
cwe:
  - CWE-863
vendor: Apache Software Foundation
product: Apache OFBiz
affected:
  - apache_ofbiz < 24.09.08
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-05T15:50:52.995671Z'
published: '2026-11-05'
updated: '2026-11-05'
sourceUpdated: '2026-11-05T15:52:11.192Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-84728'
references:
  - url: 'https://lists.apache.org/thread.html/7b2syzksp7klt9fvhdg0olldvs2g83lz'
tags:
  - cve.org
ingestedAt: '2026-11-05T21:36:00.926Z'
---

## Overview

Incorrect Authorization in Apache OFBiz 
24.09 before 24.09.08 on all platforms, when documented multitenancy is 
enabled, allows a remote authenticated attacker holding only a valid 
low-privilege account in one tenant to read and write data belonging to a
 different tenant, by submitting their own tenant's userTenantId 
alongside their own credentials to the normal Party Manager login 
against a hostname mapped to a different tenant: ContextFilter resolves 
the tenant from the hostname via TenantDomainName, but LoginWorker gives
 priority to the conflicting userTenantId request parameter and 
authenticates against the attacker's own tenant, so a subsequent 
ordinary request to the same hostname combines the hostname-mapped 
tenant's Entity Engine delegator with the attacker's tenant's session 
dispatcher, security object, and identity, letting the permission check 
run against the attacker's own tenant while the resulting read or write 
is performed against the hostname-mapped tenant's data. Users are 
recommended to upgrade to version 24.09.08, which fixes this issue.

## Affected

- `apache_ofbiz < 24.09.08`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.