CVE Feed

    Dashboard / CVE / CVE-2026-81744

    CVE-2026-81744

    Incorrect Authorization in ContentPermissionServices in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote authenticated attacker holding only a limited content-create permission to self-grant the OWNER role on arbitrary content by invoking the createContentRole service (e.g. via the createForumGroupRole request), causing the permission check to fall through to a fail-open default-grant branch when no ContentPurposeOperation entry matches the requested operation and content purpose, rather than denying the request. A self-granted OWNER role then satisfies the ownership check used to authorize update, removal, and status changes on that content, giving the attacker full read/write/delete control over content they should not have access to. Users are recommended to upgrade to version 24.09.08, which fixes this issue.

    Published:Nov 5, 2026
    Last Modified:Nov 5, 2026
    EPS:Nov 5, 2026
    EPSS Score:
    CVSS Score:

    Affected Products

    Vendor
    Apache
    Product
    Ofbiz
    Vendor
    Apache Software Foundation
    Product
    Apache Ofbiz

    Exploits

    No exploit reference

    Common Weakness Enumeration

    CWE-862 Missing Authorization

    Common Attack Pattern Enumeration and Classification (CAPEC)

    CAPEC-665 Exploitation of Thunderbolt Protection Flaws

    Related CVEs

    CVE-2026-66903 — Authenticated Path Traversal in Catalog Image Management allows writing image files outside the intended direc…
    CVE-2026-71901 — Improper Control of Resource Identifiers ('Resource Injection') vulnerability in Apache OFBiz. An authentic…
    CVE-2026-68524 — An unauthenticated attacker can exploit temporary-file handling, access an open file descriptor, and inject a …
    CVE-2026-73578 — Missing authorization enforcement in RequestHandler.renderView in Apache OFBiz 24.09 before 24.09.08 on all pl…
    CVE-2026-73580 — Missing authorization check in the getHRChild service in Apache OFBiz through 24.09.07 on all platforms allows…
    CVE-2026-74841 — In multitenant deployments, ContextFilter and LoginWorker built a per-tenant delegator name from a request-sup…
    CVE-2026-76150 — Path traversal and missing authorization check in the replaceImageToExistImage service in Apache OFBiz through…
    CVE-2026-81734 — Missing Authorization in ProductEvents in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote …
    CVE-2026-76152 — Path traversal and missing authorization check in the imageCrop and imageRotate services in Apache OFBiz throu…
    CVE-2026-81808 — Missing Authorization in ProductSearchEvents in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a r…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High