CVE-2026-82902
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk30th percentile - higher than 30% of all known CVEs
Summary
Server-Side Request Forgery in ViewDataFile in Apache OFBiz 24.09 before 24.09.08 allows a remote authenticated attacker with base webtools permissions (OFBTOOLS_VIEW, WEBTOOLS_VIEW) to cause the server to issue arbitrary outbound HTTP requests, and an attacker with ENTITY_MAINT and DATAFILE_MAINT to read arbitrary local files via file: URL, by supplying DEFINITION_LOCATION or DATAFILE_LOCATION parameters, because ViewDataFile.groovy dereferences them as java.net.URL without scheme allow-list, host filter, or egress control.
Risk Assessment
An attacker can use the server for SSRF attacks or local file reads, potentially leading to data leakage or further exploitation.
Recommendation
Upgrade Apache OFBiz to version 24.09.08, which fixes this issue.
Other vulnerabilities in Apache OFBiz
See all- CVE-2026-97356Unknown
An External Control of File Name or Path vulnerability in the ViewFile component of Label Manager in Apache OFBiz 24.09.07 allows an authenticated user with only the LABEL_MANAGER_VIEW permission to read arbitrary properties and XML files on the server, including the JWT signing key, enabling forgery of an authenticated administrator session.
- CVE-2026-97355Unknown
A Use of Hard-coded Password vulnerability in the AdminServer component in Apache OFBiz 24.09.07 allows an attacker able to reach the AdminServer control port to query the server's running state and trigger an unauthenticated shutdown of the instance via the fixed default control key shipped in start.properties.
- CVE-2026-92887Unknown
An incorrect default value in the REST API framework's .rest.xml definition parser (ModelApiReader) in Apache OFBiz through 24.09.07 allows a remote, unauthenticated attacker to invoke a REST API operation without valid credentials when a definition omits the auth attribute, which is incorrectly resolved to false instead of the true default.
- CVE-2026-83538Unknown
Missing Authorization in Apache OFBiz 24.09 before 24.09.08 allows a remote unauthenticated attacker to disclose internal business records (organization, employee, product catalog, and product-store data) by requesting several helper endpoints across the Human Resources, Catalog, and Order Manager applications that skip authentication and perform no permission check.
- CVE-2026-114277Unknown
Authentication bypass by Assumed-Immutable data in the optional Janrain Engage Social Login integration in the ecommerce component of Apache OFBiz before 24.09.08 improperly binds authenticated external identities to local user accounts.
- CVE-2026-114272Unknown
Authorization Bypass Through User-Controlled Key in the content viewing component in Apache OFBiz 24.09 before 24.09.08 allows an authenticated user with role-scoped content view permission to read data of content they are not authorized to view via a ViewSimpleContent request combining a contentId they can view with the dataResourceId of other content.
- CVE-2026-114271Unknown
Authorization bypass through a user-controlled key in the shopping list services in Apache OFBiz 24.09 before 24.09.08 allows an authenticated low-privileged user, such as a self-registered ecommerce customer, to modify or take ownership of another party's shopping list and read its contents by supplying the other party's shopping list ID to the update endpoint.
- CVE-2026-114235Unknown
Direct request (forced browsing) in the Order component in Apache OFBiz 24.09 before 24.09.08 allows an authenticated user with only view access to the Order Manager to modify the shipment tracking number of any order via a direct request to the updateTrackingNumber endpoint.
- CVE-2026-114233Unknown
Incorrect privilege assignment in the Order Manager in Apache OFBiz 24.09 before 24.09.08 allows an authenticated user holding only ORDERMGR_VIEW permission, without ORDERMGR_UPDATE or any role on the order, to modify approved orders — changing a ship group's shipping address and shipment method or appending items with an overridden price — via the updateShipGroupShipInfo and appendOrderItem services.
- CVE-2026-114229Unknown
Improper neutralization of input during web page generation (cross-site scripting) in the Catalog image viewer in Apache OFBiz 24.09 before 24.09.08 allows an unauthenticated attacker to execute arbitrary JavaScript in the browser session of a logged-in back-office user via a crafted viewImage URL that the user opens from within the application.
Original NVD description (English source)
Server-Side Request Forgery in ViewDataFile in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote authenticated attacker holding only the base webtools permissions (OFBTOOLS_VIEW, WEBTOOLS_VIEW) to cause the server to issue arbitrary outbound HTTP requests, and an attacker additionally holding ENTITY_MAINT and DATAFILE_MAINT to read arbitrary local files via a file: URL, by supplying the DEFINITION_LOCATION or DATAFILE_LOCATION request parameter to the viewdatafile screen, because ViewDataFile.groovy dereferences both parameters as java.net.URL objects with no scheme allow-list, host filter, or egress control inside a screen action that runs before the screen's and template's permission checks are evaluated, so the fetch executes regardless of whether the requesting account is authorized to view its result. Users are recommended to upgrade to version 24.09.08, which fixes this issue.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS