CVE Feed

    Dashboard / CVE / CVE-2026-81734

    CVE-2026-81734

    Missing Authorization in ProductEvents in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote authenticated attacker holding only catalog view permission to create, modify, or remove arbitrary product, product feature association, and product category association data by directly invoking catalog quick-admin events such as updateProductQuickAdminShipping, causing the servlet to authorize the request against the base view-level permission declared on the request-map while the underlying event methods perform entity-engine writes without checking the catalog update/create permission enforced by equivalent sibling event methods in the same class. Users are recommended to upgrade to version 24.09.08, which fixes this issue.

    Published:Nov 5, 2026
    Last Modified:Nov 5, 2026
    EPS:Nov 5, 2026
    EPSS Score:
    CVSS Score:

    Affected Products

    Vendor
    Apache
    Product
    Ofbiz
    Vendor
    Apache Software Foundation
    Product
    Apache Ofbiz

    Exploits

    No exploit reference

    Common Weakness Enumeration

    CWE-862 Missing Authorization

    Common Attack Pattern Enumeration and Classification (CAPEC)

    CAPEC-665 Exploitation of Thunderbolt Protection Flaws

    Related CVEs

    CVE-2026-66903 — Authenticated Path Traversal in Catalog Image Management allows writing image files outside the intended direc…
    CVE-2026-71901 — Improper Control of Resource Identifiers ('Resource Injection') vulnerability in Apache OFBiz. An authentic…
    CVE-2026-68524 — An unauthenticated attacker can exploit temporary-file handling, access an open file descriptor, and inject a …
    CVE-2026-73578 — Missing authorization enforcement in RequestHandler.renderView in Apache OFBiz 24.09 before 24.09.08 on all pl…
    CVE-2026-73580 — Missing authorization check in the getHRChild service in Apache OFBiz through 24.09.07 on all platforms allows…
    CVE-2026-74841 — In multitenant deployments, ContextFilter and LoginWorker built a per-tenant delegator name from a request-sup…
    CVE-2026-76150 — Path traversal and missing authorization check in the replaceImageToExistImage service in Apache OFBiz through…
    CVE-2026-76152 — Path traversal and missing authorization check in the imageCrop and imageRotate services in Apache OFBiz throu…
    CVE-2026-81744 — Incorrect Authorization in ContentPermissionServices in Apache OFBiz 24.09 before 24.09.08 on all platforms al…
    CVE-2026-81808 — Missing Authorization in ProductSearchEvents in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a r…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High