CVE-2026-109856

An External Control of File Name or Path vulnerability in the ViewFile component of Label Manager in Apache OFBiz 24.09.07 allows an authenticated user with only the LABEL_MANAGER_VIEW permission to read arbitrary properties and XML files on the server, including the JWT signing key, enabling forgery of an authenticated administrator session.

A Use of Hard-coded Password vulnerability in the AdminServer component in Apache OFBiz 24.09.07 allows an attacker able to reach the AdminServer control port to query the server's running state and trigger an unauthenticated shutdown of the instance via the fixed default control key shipped in start.properties.

An incorrect default value in the REST API framework's .rest.xml definition parser (ModelApiReader) in Apache OFBiz through 24.09.07 allows a remote, unauthenticated attacker to invoke a REST API operation without valid credentials when a definition omits the auth attribute, which is incorrectly resolved to false instead of the true default.

Missing Authorization in Apache OFBiz 24.09 before 24.09.08 allows a remote unauthenticated attacker to disclose internal business records (organization, employee, product catalog, and product-store data) by requesting several helper endpoints across the Human Resources, Catalog, and Order Manager applications that skip authentication and perform no permission check.

Authentication bypass by Assumed-Immutable data in the optional Janrain Engage Social Login integration in the ecommerce component of Apache OFBiz before 24.09.08 improperly binds authenticated external identities to local user accounts.

Authorization Bypass Through User-Controlled Key in the content viewing component in Apache OFBiz 24.09 before 24.09.08 allows an authenticated user with role-scoped content view permission to read data of content they are not authorized to view via a ViewSimpleContent request combining a contentId they can view with the dataResourceId of other content.

Authorization bypass through a user-controlled key in the shopping list services in Apache OFBiz 24.09 before 24.09.08 allows an authenticated low-privileged user, such as a self-registered ecommerce customer, to modify or take ownership of another party's shopping list and read its contents by supplying the other party's shopping list ID to the update endpoint.

Direct request (forced browsing) in the Order component in Apache OFBiz 24.09 before 24.09.08 allows an authenticated user with only view access to the Order Manager to modify the shipment tracking number of any order via a direct request to the updateTrackingNumber endpoint.

Incorrect privilege assignment in the Order Manager in Apache OFBiz 24.09 before 24.09.08 allows an authenticated user holding only ORDERMGR_VIEW permission, without ORDERMGR_UPDATE or any role on the order, to modify approved orders — changing a ship group's shipping address and shipment method or appending items with an overridden price — via the updateShipGroupShipInfo and appendOrderItem services.

Improper neutralization of input during web page generation (cross-site scripting) in the Catalog image viewer in Apache OFBiz 24.09 before 24.09.08 allows an unauthenticated attacker to execute arbitrary JavaScript in the browser session of a logged-in back-office user via a crafted viewImage URL that the user opens from within the application.