CVE-2026-82916
Awaiting Analysis Awaiting Analysis - Queue

Missing Authorization in Apache OFBiz XmlDsDump

Publication date: 2026-11-05

Last updated on: 2026-11-05

Assigner: Apache Software Foundation

Description
Missing Authorization in XmlDsDump in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote authenticated attacker holding only the webtools base permissions (OFBTOOLS_VIEW, WEBTOOLS_VIEW) — explicitly not the ENTITY_MAINT permission the export feature declares and visibly refuses to render for — to export the contents of any database entity, including UserLogin with its currentPassword hashes, to any filesystem path the OFBiz process can write, including a web-served docroot, and to create arbitrary directories or truncate arbitrary existing files at those paths, because the XmlDsDump screen action writes the requested entity data via new FileOutputStream on unvalidated outpath and filename request parameters before the screen's ENTITY_MAINT permission check runs, unlike the equivalent Java service entityExportAll, which enforces both a permission check and a file-path allow-list. Users are recommended to upgrade to version 24.09.08, which fixes this issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-05
Last Modified
2026-11-05
Generated
2026-11-05
AI Q&A
2026-11-05
EPSS Evaluated
N/A
NVD
CVE-2026-82916
EUVD
EUVD-2026-117474

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Apache Software Foundation Apache OFBiz 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-73 The product allows user input to control or influence paths or file names that are used in filesystem operations.
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a missing authorization flaw in XmlDsDump in Apache OFBiz 24.09 before 24.09.08. A remote authenticated attacker with only basic webtools permissions can exploit it to export database contents, including sensitive UserLogin data with password hashes, to any writable filesystem path. The issue occurs because the XmlDsDump screen action writes data via FileOutputStream before performing the required permission check.

Detection Guidance

Check Apache OFBiz versions before 24.09.08. Look for unauthorized database exports or file writes in logs. Monitor for suspicious XmlDsDump screen actions or unexpected file creation in web-served directories.

Impact Analysis

An attacker could access sensitive data like user passwords, create or overwrite files in web directories, or disrupt services by truncating critical files. This could lead to data breaches, unauthorized access, or system instability if exploited.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR (data protection) and HIPAA (health data privacy) due to unauthorized access to sensitive user data. Organizations may face legal penalties, reputational damage, and mandatory breach notifications if exploited.

Mitigation Strategies

Upgrade Apache OFBiz to version 24.09.08 or later immediately. Remove or restrict access to the XmlDsDump screen action until patched. Review and audit file system permissions for the OFBiz process.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-82916. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...