CVE-2026-114272

MediumCVSS 6.5/10Last modified Nov 10, 2026

Description

Authorization Bypass Through User-Controlled Key in the content viewing component in Apache OFBiz 24.09 before 24.09.08 on all platforms allows an authenticated user with role-scoped content view permission to read the data of content they are not authorized to view via a ViewSimpleContent request that combines a contentId they can view with the dataResourceId of other content. Users are recommended to upgrade to version 24.09.08, which fixes this issue.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-639

Affected software

Vendor	Product	Versions
Apache Software Foundation	Apache OFBiz	< 24.09.08

References

https://lists.apache.org/thread.html/7b2syzksp7klt9fvhdg0olldvs2g83lzMailing List, Vendor Advisory

Timeline

Published: Nov 5, 2026
Last modified: Nov 10, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-1142776.5Authentication bypass by Assumed-Immutable data vulnerability in Apache OFBiz. Apache OFBiz's optional Janrain Engage Social Login integrati CVE-2026-1142789.8The che-machine-exec service constructs a shell command by concatenating user-controlled input (the username and namespace fields from the /CVE-2026-1142910.0Two endpoints in the Vault Service ScriptsController, shared by Altium Enterprise Server and Altium 365, accept file uploads where a user-su CVE-2026-11438.8A weakness has been identified in TOTOLINK A3700R 9.1.2u.5822_B20200513. This affects the function setWiFiEasyGuestCfg of the file /cgi-bin/CVE-2026-114307.3Grav CMS's scheduler-webhook plugin contains an authentication bypass in the webhook token check. When the webhook feature is enabled but no CVE-2026-114318.3A path traversal vulnerability exists in the Projects Service download endpoint shared by Altium Enterprise Server and Altium 365. An authen CVE-2026-114342.4A weakness has been identified in FluentCMS 0.0.5. The impacted element is an unknown function of the file /admin/blocks of the component Bl CVE-2026-1143485.3webpack-dev-server is a development server that provides live reloading for webpack projects. In versions from 5.1.0 before 5.2.7 and in ver CVE-2026-1143496.5When a broker decodes a compressed record batch, the per-record decoder reads a declared body size from the decompressed stream and allocate CVE-2026-114357.3A security vulnerability has been detected in Jinher OA 1.0. This affects an unknown function of the file nextselectplan.aspx. Such manipula CVE-2026-1143537.0Hidden functionality (undocumented backdoor) in the root-privileged 'assistant' daemon in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0 CVE-2026-1143548.6Missing authorization in the native binder service 'android.dji.server' (transaction code 1018) in DJI CrystalSky ZS600C firmware v0.3.9.7 t