CVE-2026-84728
Awaiting Analysis Awaiting Analysis - Queue

Incorrect Authorization in Apache OFBiz

Publication date: 2026-11-05

Last updated on: 2026-11-05

Assigner: Apache Software Foundation

Description
Incorrect Authorization in Apache OFBiz 24.09 before 24.09.08 on all platforms, when documented multitenancy is enabled, allows a remote authenticated attacker holding only a valid low-privilege account in one tenant to read and write data belonging to a different tenant, by submitting their own tenant's userTenantId alongside their own credentials to the normal Party Manager login against a hostname mapped to a different tenant: ContextFilter resolves the tenant from the hostname via TenantDomainName, but LoginWorker gives priority to the conflicting userTenantId request parameter and authenticates against the attacker's own tenant, so a subsequent ordinary request to the same hostname combines the hostname-mapped tenant's Entity Engine delegator with the attacker's tenant's session dispatcher, security object, and identity, letting the permission check run against the attacker's own tenant while the resulting read or write is performed against the hostname-mapped tenant's data. Users are recommended to upgrade to version 24.09.08, which fixes this issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-05
Last Modified
2026-11-05
Generated
2026-11-05
AI Q&A
2026-11-05
EPSS Evaluated
N/A
NVD
CVE-2026-84728
EUVD
EUVD-2026-117468

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Apache Software Foundation Apache OFBiz 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an Incorrect Authorization issue in Apache OFBiz versions before 24.09.08. When multitenancy is enabled, a remote authenticated attacker with a low-privilege account in one tenant can read or write data belonging to a different tenant. The attacker exploits a conflict between the tenant resolved from the hostname and a user-provided tenant ID parameter to bypass authorization checks.

Detection Guidance

To detect this vulnerability, check if Apache OFBiz is running version 24.09 before 24.09.08 with multitenancy enabled. Verify if low-privilege users can access data from other tenants by inspecting login requests for the userTenantId parameter alongside credentials.

Impact Analysis

If you use Apache OFBiz with multitenancy enabled and an outdated version, an attacker could access or modify data across tenants. This could lead to unauthorized data exposure, data corruption, or privilege escalation within your system, potentially affecting multiple tenants' data integrity and confidentiality.

Compliance Impact

This vulnerability could violate compliance with GDPR, HIPAA, or other data protection regulations by enabling unauthorized access to sensitive tenant data. It undermines data segregation requirements and could result in legal penalties, reputational damage, and loss of trust due to data breaches.

Mitigation Strategies

Upgrade Apache OFBiz to version 24.09.08 or later to fix the incorrect authorization issue. Disable multitenancy if not required or ensure proper tenant isolation is enforced.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-84728. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...