CVE-2026-100168
Awaiting Analysis Awaiting Analysis - Queue

Direct Request Forced Browsing in Apache OFBiz

Publication date: 2026-11-05

Last updated on: 2026-11-05

Assigner: Apache Software Foundation

Description
Direct Request ('Forced Browsing') in the Content Manager component in Apache OFBiz 24.09.07 on all platforms allows an authenticated user holding only view-only content permissions (OFBTOOLS_VIEW and CONTENTMGR_VIEW) to re-parent content associations they do not own or manage via a direct POST request to the moveContentJson endpoint, which performs no permission check, unlike the equivalent updateContent/createContentAssoc/removeContentAssoc services that require genericContentPermission UPDATE. Users are recommended to upgrade to version 24.09.08, which fixes this issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-05
Last Modified
2026-11-05
Generated
2026-11-05
AI Q&A
2026-11-05
EPSS Evaluated
N/A
NVD
CVE-2026-100168
EUVD
EUVD-2026-117461

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Apache Software Foundation Apache OFBiz 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-425 The web application does not adequately enforce appropriate authorization on all restricted URLs, scripts, or files.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a Direct Request or Forced Browsing issue in Apache OFBiz 24.09.07. An authenticated user with only view-only content permissions can re-parent content associations they do not own by sending a direct POST request to the moveContentJson endpoint. This endpoint does not perform proper permission checks, unlike other similar services that require UPDATE permissions.

Detection Guidance

Check Apache OFBiz logs for unauthorized POST requests to the moveContentJson endpoint. Look for requests from users with only view-only permissions attempting to modify content associations.

Impact Analysis

An attacker with view-only access could manipulate content associations, potentially altering data relationships or exposing sensitive information. This could lead to unauthorized changes in content structure or access to restricted data, compromising the integrity of the system.

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating compliance requirements for data integrity and access control in standards like GDPR and HIPAA. Organizations using affected versions may face compliance violations and potential legal consequences.

Mitigation Strategies

Upgrade Apache OFBiz to version 24.09.08 or later to fix the issue. Ensure all users have only the minimum required permissions and review content association permissions.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-100168. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...