CVE-2026-81808
Received Received - Intake

Missing Authorization in Apache OFBiz

Publication date: 2026-11-05

Last updated on: 2026-11-05

Assigner: Apache Software Foundation

Description
Missing Authorization in ProductSearchEvents in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote authenticated attacker holding only catalog view permission to bulk-modify product category and feature associations across arbitrary search results by seeding a broad product search and then invoking search-result mutation events such as searchRemoveFromCategory, searchExpireFromCategory, searchAddToCategory, searchAddFeature, and searchRemoveFeature, causing the servlet to authorize the request against only the base view-level permission declared on the request-map while the underlying event methods perform bulk entity-engine deletes/inserts without checking the DELETE/CREATE permission enforced by the equivalent service-layer operations (e.g. removeProductFromCategory). Users are recommended to upgrade to version 24.09.08, which fixes this issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-05
Last Modified
2026-11-05
Generated
2026-11-05
AI Q&A
2026-11-05
EPSS Evaluated
N/A
NVD
CVE-2026-81808
EUVD
EUVD-2026-117484

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Apache Software Foundation Apache OFBiz 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in Apache OFBiz 24.09 before 24.09.08 allows a remote authenticated attacker with only catalog view permission to modify product category and feature associations across arbitrary search results. The attacker can exploit search-result mutation events like searchRemoveFromCategory or searchAddToCategory to perform bulk database changes without proper authorization checks.

Detection Guidance

To detect this vulnerability, check Apache OFBiz logs for suspicious bulk modification events in product categories or features. Look for repeated calls to searchRemoveFromCategory, searchExpireFromCategory, searchAddToCategory, searchAddFeature, or searchRemoveFeature by users with only catalog view permissions. Verify if unauthorized modifications occurred in product associations.

Impact Analysis

An attacker could alter product categories or features in bulk, potentially leading to incorrect product listings, unauthorized changes to product visibility, or data corruption. This could disrupt business operations, mislead customers, or cause inventory and pricing inconsistencies.

Mitigation Strategies

Immediately upgrade Apache OFBiz to version 24.09.08 or later. Temporarily restrict access to the vulnerable endpoints by reviewing and tightening servlet permissions in the request-map configuration. Monitor for any unauthorized bulk modifications in product categories or features until the upgrade is complete.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-81808. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...