CVE-2026-114272
Awaiting Analysis Awaiting Analysis - Queue

Authorization Bypass in Apache OFBiz Content Viewing

Publication date: 2026-11-05

Last updated on: 2026-11-05

Assigner: Apache Software Foundation

Description
Authorization Bypass Through User-Controlled Key in the content viewing component in Apache OFBiz 24.09 before 24.09.08 on all platforms allows an authenticated user with role-scoped content view permission to read the data of content they are not authorized to view via a ViewSimpleContent request that combines a contentId they can view with the dataResourceId of other content. Users are recommended to upgrade to version 24.09.08, which fixes this issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-05
Last Modified
2026-11-05
Generated
2026-11-05
AI Q&A
2026-11-05
EPSS Evaluated
N/A
NVD
CVE-2026-114272
EUVD
EUVD-2026-117444

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Apache Software Foundation Apache OFBiz 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an authorization bypass in Apache OFBiz 24.09 before 24.09.08. It allows an authenticated user with limited content view permissions to read unauthorized content by manipulating a ViewSimpleContent request. The attacker combines a contentId they can access with the dataResourceId of restricted content to bypass access controls.

Impact Analysis

If you use Apache OFBiz 24.09 before 24.09.08, an attacker with basic user permissions could access sensitive data they are not authorized to view. This could lead to data leaks, unauthorized information disclosure, or compliance violations depending on the exposed data.

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, violating GDPR's data protection principles or HIPAA's privacy rules. Organizations using affected OFBiz versions may face compliance failures, legal penalties, or reputational damage due to data breaches.

Mitigation Strategies

Upgrade Apache OFBiz to version 24.09.08 or later to fix the authorization bypass issue in the content viewing component.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-114272. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...