CVE-2026-81744
Received Received - Intake

Incorrect Authorization in Apache OFBiz ContentPermissionServices

Publication date: 2026-11-05

Last updated on: 2026-11-05

Assigner: Apache Software Foundation

Description
Incorrect Authorization in ContentPermissionServices in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote authenticated attacker holding only a limited content-create permission to self-grant the OWNER role on arbitrary content by invoking the createContentRole service (e.g. via the createForumGroupRole request), causing the permission check to fall through to a fail-open default-grant branch when no ContentPurposeOperation entry matches the requested operation and content purpose, rather than denying the request. A self-granted OWNER role then satisfies the ownership check used to authorize update, removal, and status changes on that content, giving the attacker full read/write/delete control over content they should not have access to. Users are recommended to upgrade to version 24.09.08, which fixes this issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-05
Last Modified
2026-11-05
Generated
2026-11-05
AI Q&A
2026-11-05
EPSS Evaluated
N/A
NVD
CVE-2026-81744
EUVD
EUVD-2026-117485

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Apache Software Foundation Apache OFBiz 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in Apache OFBiz 24.09 before 24.09.08 allows a remote authenticated attacker with limited content-create permission to self-grant the OWNER role on any content. This happens because the system incorrectly authorizes the request, bypassing proper permission checks. Once granted OWNER role, the attacker gains full read, write, and delete control over that content.

Detection Guidance

Detecting this vulnerability requires checking Apache OFBiz versions and reviewing service invocations. Verify OFBiz version is 24.09.08 or later. Check logs for createContentRole or createForumGroupRole service calls by limited-permission users. Look for unauthorized OWNER role grants in content permissions.

Impact Analysis

If you use Apache OFBiz 24.09 before 24.09.08, an attacker with limited access could escalate privileges and take full control of your content. This could lead to unauthorized data modification, deletion, or exposure of sensitive information stored in the system.

Compliance Impact

This vulnerability could lead to unauthorized access and modification of sensitive data, violating GDPR and HIPAA requirements for data integrity and confidentiality. Organizations using vulnerable versions may face compliance violations, legal penalties, and reputational damage.

Mitigation Strategies

Immediately upgrade Apache OFBiz to version 24.09.08 or later. Review and revoke any unauthorized OWNER role grants. Audit content permissions and service invocations for suspicious createContentRole or createForumGroupRole requests. Monitor for unauthorized content modifications.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-81744. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...