CVE-2026-92887
Awaiting Analysis Awaiting Analysis - Queue

Incorrect Default REST API Authentication Bypass in Apache OFBiz

Publication date: 2026-11-05

Last updated on: 2026-11-05

Assigner: Apache Software Foundation

Description
Incorrect default value in the REST API framework's .rest.xml definition parser (ModelApiReader) in Apache OFBiz through 24.09.07 on all platforms allows a remote, unauthenticated attacker to invoke a REST API operation without providing valid credentials via a .rest.xml resource or operation definition that omits the auth attribute, which ModelApiReader incorrectly resolves to false instead of the true default declared by rest-api.xsd. Users are recommended to upgrade to version 24.09.08, which fixes this issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-05
Last Modified
2026-11-05
Generated
2026-11-05
AI Q&A
2026-11-05
EPSS Evaluated
N/A
NVD
CVE-2026-92887
EUVD
EUVD-2026-117465

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Apache Software Foundation Apache OFBiz 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-1188 The product initializes or sets a resource with a default that is intended to be changed by the product's installer, administrator, or maintainer, but the default is not secure.
CWE-306 The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves Apache OFBiz's REST API framework where a default value in the .rest.xml definition parser is incorrectly set. The parser (ModelApiReader) allows remote unauthenticated attackers to call REST API operations without valid credentials if the .rest.xml resource omits the auth attribute. The parser incorrectly treats the missing auth attribute as false instead of the true default defined in rest-api.xsd.

Impact Analysis

An attacker could exploit this to perform unauthorized actions via the REST API, potentially accessing sensitive data or modifying system configurations without authentication. This could lead to data breaches, unauthorized transactions, or system compromise depending on the exposed API endpoints.

Compliance Impact

This vulnerability could violate compliance requirements such as GDPR or HIPAA by enabling unauthorized access to personal or health data. It undermines authentication controls, potentially leading to data exposure and non-compliance with privacy and security regulations.

Mitigation Strategies

Upgrade Apache OFBiz to version 24.09.08 or later to fix the incorrect default value in the REST API framework's .rest.xml definition parser.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-92887. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...