Skip to content
Fencer Vulns
no cvss —

CVE-2026-73580 json

Apache OFBiz: Unauthenticated HR organization and employee disclosure

published 2026-11-05 4 d ago modified 2026-11-06 2 d ago also EUVD-2026-117490

cvss
—
not scored
cisa kev
Not listed
not in CISA's catalog
epss
0.2%
EPSS 0.2% chance of exploitation in 30 days, percentile 13%
public exploits
0
none known

Summary

Missing authorization check in the getHRChild service in Apache OFBiz through 24.09.07 on all platforms allows a remote unauthenticated attacker to recursively enumerate Human Resources organization and employee data, including department names and identifiers, employment position names and identifiers, employee party identifiers, position occupancy, and organization relationships, via a crafted partyId parameter. Users are recommended to upgrade to version 24.09.08, which fixes this issue.

Patch / fix

  • Apache Software Foundation Apache OFBiz 24.09.08

Exploit prediction

0.22% chance of exploitation in the next 30 days, higher than 13% of all scored CVEs (FIRST EPSS, 2026-11-08).

Affected products

  • Apache Software Foundation Apache OFBiz

Classification

Weakness
  • CWE-862 Missing Authorization
  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.