CVE Feed

    Dashboard / CVE / CVE-2026-73578

    CVE-2026-73578

    Missing authorization enforcement in RequestHandler.renderView in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote unauthenticated attacker to bypass the request-map authentication policy for protected views by supplying a crafted _LAST_VIEW_NAME_ value, which is stored as saved-view state in the anonymous session and later rendered without re-applying the original view's authentication requirement, potentially exposing protected views and associated business data. Users are recommended to upgrade to version 24.09.08, which fixes this issue.

    Published:Nov 5, 2026
    Last Modified:Nov 5, 2026
    EPS:Nov 5, 2026
    EPSS Score:
    CVSS Score:

    Affected Products

    Vendor
    Apache
    Product
    Ofbiz
    Vendor
    Apache Software Foundation
    Product
    Apache Ofbiz

    Exploits

    No exploit reference

    Common Attack Pattern Enumeration and Classification (CAPEC)

    CAPEC-127 Directory Indexing
    CAPEC-665 Exploitation of Thunderbolt Protection Flaws

    Related CVEs

    CVE-2026-66903 — Authenticated Path Traversal in Catalog Image Management allows writing image files outside the intended direc…
    CVE-2026-71901 — Improper Control of Resource Identifiers ('Resource Injection') vulnerability in Apache OFBiz. An authentic…
    CVE-2026-68524 — An unauthenticated attacker can exploit temporary-file handling, access an open file descriptor, and inject a …
    CVE-2026-73580 — Missing authorization check in the getHRChild service in Apache OFBiz through 24.09.07 on all platforms allows…
    CVE-2026-74841 — In multitenant deployments, ContextFilter and LoginWorker built a per-tenant delegator name from a request-sup…
    CVE-2026-76150 — Path traversal and missing authorization check in the replaceImageToExistImage service in Apache OFBiz through…
    CVE-2026-81734 — Missing Authorization in ProductEvents in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote …
    CVE-2026-76152 — Path traversal and missing authorization check in the imageCrop and imageRotate services in Apache OFBiz throu…
    CVE-2026-81744 — Incorrect Authorization in ContentPermissionServices in Apache OFBiz 24.09 before 24.09.08 on all platforms al…
    CVE-2026-81808 — Missing Authorization in ProductSearchEvents in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a r…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High