Skip to content
Fencer Vulns
no cvss —

CVE-2026-83538 json

Apache OFBiz: Unauthenticated disclosure through HR, Catalog, and Order Manager helpers

published 2026-11-05 4 d ago modified 2026-11-05 4 d ago also EUVD-2026-117472

cvss
—
not scored
cisa kev
Not listed
not in CISA's catalog
epss
0.3%
EPSS 0.3% chance of exploitation in 30 days, percentile 21%
public exploits
0
none known

Summary

Missing Authorization in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote unauthenticated attacker to disclose internal business records — including organization, employee, product catalog, and product-store data — by requesting several helper endpoints across the Human Resources, Catalog, and Order Manager applications that are configured to skip authentication and perform no permission check before returning the requested record. Users are recommended to upgrade to version 24.09.08, which fixes this issue.

Patch / fix

  • Apache Software Foundation Apache OFBiz 24.09.08

Exploit prediction

0.29% chance of exploitation in the next 30 days, higher than 21% of all scored CVEs (FIRST EPSS, 2026-11-08).

Affected products

  • Apache Software Foundation Apache OFBiz

Classification

Weakness
  • CWE-862 Missing Authorization
  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.