CVE-2026-84728
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk20th percentile - higher than 20% of all known CVEs
Summary
An Incorrect Authorization vulnerability in Apache OFBiz 24.09 before 24.09.08, when multitenancy is enabled, allows a remote authenticated attacker with a low-privilege account in one tenant to read and write data belonging to a different tenant by manipulating the userTenantId parameter during login.
Risk Assessment
An attacker can access data of other tenants, breaking multitenancy isolation and compromising data confidentiality.
Recommendation
Upgrade Apache OFBiz to version 24.09.08, which fixes this issue.
Other vulnerabilities in Apache OFBiz
See all- CVE-2026-97356Unknown
An External Control of File Name or Path vulnerability in the ViewFile component of Label Manager in Apache OFBiz 24.09.07 allows an authenticated user with only the LABEL_MANAGER_VIEW permission to read arbitrary properties and XML files on the server, including the JWT signing key, enabling forgery of an authenticated administrator session.
- CVE-2026-97355Unknown
A Use of Hard-coded Password vulnerability in the AdminServer component in Apache OFBiz 24.09.07 allows an attacker able to reach the AdminServer control port to query the server's running state and trigger an unauthenticated shutdown of the instance via the fixed default control key shipped in start.properties.
- CVE-2026-92887Unknown
An incorrect default value in the REST API framework's .rest.xml definition parser (ModelApiReader) in Apache OFBiz through 24.09.07 allows a remote, unauthenticated attacker to invoke a REST API operation without valid credentials when a definition omits the auth attribute, which is incorrectly resolved to false instead of the true default.
- CVE-2026-83538Unknown
Missing Authorization in Apache OFBiz 24.09 before 24.09.08 allows a remote unauthenticated attacker to disclose internal business records (organization, employee, product catalog, and product-store data) by requesting several helper endpoints across the Human Resources, Catalog, and Order Manager applications that skip authentication and perform no permission check.
- CVE-2026-114277Unknown
Authentication bypass by Assumed-Immutable data in the optional Janrain Engage Social Login integration in the ecommerce component of Apache OFBiz before 24.09.08 improperly binds authenticated external identities to local user accounts.
- CVE-2026-114272Unknown
Authorization Bypass Through User-Controlled Key in the content viewing component in Apache OFBiz 24.09 before 24.09.08 allows an authenticated user with role-scoped content view permission to read data of content they are not authorized to view via a ViewSimpleContent request combining a contentId they can view with the dataResourceId of other content.
- CVE-2026-114271Unknown
Authorization bypass through a user-controlled key in the shopping list services in Apache OFBiz 24.09 before 24.09.08 allows an authenticated low-privileged user, such as a self-registered ecommerce customer, to modify or take ownership of another party's shopping list and read its contents by supplying the other party's shopping list ID to the update endpoint.
- CVE-2026-114235Unknown
Direct request (forced browsing) in the Order component in Apache OFBiz 24.09 before 24.09.08 allows an authenticated user with only view access to the Order Manager to modify the shipment tracking number of any order via a direct request to the updateTrackingNumber endpoint.
- CVE-2026-114233Unknown
Incorrect privilege assignment in the Order Manager in Apache OFBiz 24.09 before 24.09.08 allows an authenticated user holding only ORDERMGR_VIEW permission, without ORDERMGR_UPDATE or any role on the order, to modify approved orders — changing a ship group's shipping address and shipment method or appending items with an overridden price — via the updateShipGroupShipInfo and appendOrderItem services.
- CVE-2026-114229Unknown
Improper neutralization of input during web page generation (cross-site scripting) in the Catalog image viewer in Apache OFBiz 24.09 before 24.09.08 allows an unauthenticated attacker to execute arbitrary JavaScript in the browser session of a logged-in back-office user via a crafted viewImage URL that the user opens from within the application.
Original NVD description (English source)
Incorrect Authorization in Apache OFBiz 24.09 before 24.09.08 on all platforms, when documented multitenancy is enabled, allows a remote authenticated attacker holding only a valid low-privilege account in one tenant to read and write data belonging to a different tenant, by submitting their own tenant's userTenantId alongside their own credentials to the normal Party Manager login against a hostname mapped to a different tenant: ContextFilter resolves the tenant from the hostname via TenantDomainName, but LoginWorker gives priority to the conflicting userTenantId request parameter and authenticates against the attacker's own tenant, so a subsequent ordinary request to the same hostname combines the hostname-mapped tenant's Entity Engine delegator with the attacker's tenant's session dispatcher, security object, and identity, letting the permission check run against the attacker's own tenant while the resulting read or write is performed against the hostname-mapped tenant's data. Users are recommended to upgrade to version 24.09.08, which fixes this issue.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS