Skip to content
Fencer Vulns
no cvss —

CVE-2026-73577 json

Apache OFBiz: Unauthenticated path-suffix view authorization bypass

published 2026-11-05 4 d ago modified 2026-11-06 2 d ago also EUVD-2026-117492

cvss
—
not scored
cisa kev
Not listed
not in CISA's catalog
epss
0.3%
EPSS 0.3% chance of exploitation in 30 days, percentile 22%
public exploits
0
none known

Summary

Incorrect authorization in RequestHandler in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote unauthenticated attacker to bypass the authentication requirement of a protected view by appending it as a path suffix to a public request (e.g., /catalog/control/ListLocales/showPortalPage), causing the servlet to authorize the request based on the public path component while rendering the protected suffix view. Users are recommended to upgrade to version 24.09.08, which fixes this issue.

Patch / fix

  • Apache Software Foundation Apache OFBiz 24.09.08

Exploit prediction

0.30% chance of exploitation in the next 30 days, higher than 22% of all scored CVEs (FIRST EPSS, 2026-11-08).

Affected products

  • Apache Software Foundation Apache OFBiz

Classification

Weakness
  • CWE-288 Authentication Bypass Using an Alternate Path or Channel

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.