CVE-2026-31388
Improper Access Control in Apache OFBiz
Publication date: 2026-05-19
Last updated on: 2026-05-19
Assigner: Apache Software Foundation
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| apache | ofbiz | to 24.09.06 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-284 | The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is an Improper Access Control issue found in Apache OFBiz when used in multi-tenant deployments. It means that the software does not correctly restrict access to resources or functions, potentially allowing users to access data or perform actions they should not be permitted to.
How can this vulnerability impact me? :
The impact of this vulnerability could include unauthorized access to sensitive information or operations within a multi-tenant environment. This could lead to data breaches, unauthorized data modification, or other security issues affecting the confidentiality and integrity of your data.
What immediate steps should I take to mitigate this vulnerability?
To mitigate the Improper Access Control vulnerability in Apache OFBiz in multi-tenant deployments, users are recommended to upgrade to Apache OFBiz version 24.09.06, which fixes the issue.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability involves improper access control in multi-tenant deployments of Apache OFBiz, which can lead to cross-tenant data exposure.
Such unauthorized data exposure could potentially impact compliance with data protection regulations like GDPR and HIPAA, which require strict controls on access to personal and sensitive information.
However, the provided information does not explicitly discuss the direct effects on compliance with these standards.