{"id":4006,"date":"2026-11-06T09:28:29","date_gmt":"2026-11-06T17:28:29","guid":{"rendered":"https:\/\/cyber.mag212.com\/apache-ofbiz-24-09-08-46-cves-upgrade\/"},"modified":"2026-11-06T09:28:29","modified_gmt":"2026-11-06T17:28:29","slug":"apache-ofbiz-24-09-08-46-cves-upgrade","status":"publish","type":"post","link":"https:\/\/cyber.mag212.com\/fr\/apache-ofbiz-24-09-08-46-cves-upgrade\/","title":{"rendered":"Apache OFBiz 24.09.08 Fixes 46 CVEs, Including Pre-Auth RCE and Authentication Bypasses: What to Patch and Rotate"},"content":{"rendered":"

MAG212 CYBER | Critical CVEs | November 6, 2026<\/strong><\/p>\n\n\n\n

The Apache OFBiz project has disclosed 46 CVEs<\/strong> in a single announcement, all affecting every release before 24.09.08<\/strong>. The advisory, posted to the oss-security mailing list on 4 November 2026, says the batch includes “some critical issues” and gives one fix: upgrade to Apache OFBiz 24.09.08. Several titles describe pre-authentication remote code execution and authentication bypass. OFBiz has been a repeated target of mass exploitation, so this batch needs prompt attention, even though no exploitation has been reported yet.<\/p>\n\n\n\n

Faits cl\u00e9s<\/h2>\n\n\n\n
Article<\/th>D\u00e9tail<\/th><\/tr><\/thead>
Produit<\/strong><\/td>Apache OFBiz, the open-source ERP and e-commerce framework<\/td><\/tr>
CVE<\/strong><\/td>46, announced together on 4 November 2026<\/td><\/tr>
Affect\u00e9<\/strong><\/td>“All versions prior to 24.09.08”<\/td><\/tr>
R\u00e9parer<\/strong><\/td>Upgrade to Apache OFBiz 24.09.08<\/td><\/tr>
Gravit\u00e9<\/strong><\/td>Advisory says “some critical issues”; per-CVE ratings only in individual CVE records<\/td><\/tr>
Records published<\/strong><\/td>5 November 2026 (CVE.org)<\/td><\/tr>
Extra step<\/strong><\/td>.\/gradlew rotateSecretKeys<\/code> for deployments affected by CVE-2026-105330<\/td><\/tr>
Exploitation \/ KEV<\/strong><\/td>None reported for any of the 46 as of 6 November 2026<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n

What Apache announced<\/h2>\n\n\n\n

The announcement, titled “Apache OFBiz: CVE Announcements”, was sent by Jacopo Cappellato on 4 November 2026. It is short. It says that “multiple security vulnerabilities have been identified in Apache OFBiz, including some critical issues”, lists 46 CVE IDs with one-line titles, and advises users “to upgrade to Apache OFBiz 24.09.08, which addresses these vulnerabilities.” It has no per-CVE severity, no credits and no descriptions beyond the titles.<\/p>\n\n\n\n

Le OFBiz security page<\/a> lists the same 46 IDs as fixed in 24.09.08, each linked to its fix in the apache\/ofbiz-framework repository. Two fixes also touch the plugins repository: CVE-2026-92887 (ofbiz-plugins PR #408) and CVE-2026-114277 (ofbiz-plugins PR #454 plus framework PR #2383). The security page gives no titles, severities or credits.<\/p>\n\n\n\n

Severity and credits live in the individual CVE records, which went public on 5 November. The records we checked use Apache’s text ratings (“important”, “moderate”) and carry no CNA CVSS score and no CISA enrichment.<\/p>\n\n\n\n

All 46 CVEs, grouped by type<\/h2>\n\n\n\n

The titles below were extracted from the oss-security message and checked, where possible, against the published CVE records. The grouping is MAG212’s<\/strong>, based only on title wording. Apache did not group the CVEs, and a title alone does not tell you the exact preconditions. CVE-2026-97355 also causes denial of service but is listed once, under credentials.<\/p>\n\n\n\n

Group (MAG212)<\/th>CVE<\/th>Title as announced<\/th><\/tr><\/thead>
Unauthenticated \/ pre-auth RCE<\/td>CVE-2026-68524<\/td>Pre-Authentication Remote Code Execution via Attacker-Controlled Screen Definition Loading<\/td><\/tr>
Unauthenticated \/ pre-auth RCE<\/td>CVE-2026-83542<\/td>Unauthenticated RCE via login-page widget injection<\/td><\/tr>
Unauthenticated \/ pre-auth RCE<\/td>CVE-2026-73578<\/td>Unauthenticated saved-view authorization bypass with RCE impact<\/td><\/tr>
Authenticated code execution<\/td>CVE-2026-82960<\/td>Widget use-when Expression Injection Bypasses Groovy Sandbox for authenticated RCE<\/td><\/tr>
Authenticated code execution<\/td>CVE-2026-84183<\/td>Content Manager VIEW-only RCE in updateLayout<\/td><\/tr>
Authenticated code execution<\/td>CVE-2026-85627<\/td>Authenticated Code Execution Vulnerability<\/td><\/tr>
Authenticated code execution<\/td>CVE-2026-82912<\/td>Unsandboxed Groovy compiled from a service parameter<\/td><\/tr>
Authenticated code execution<\/td>CVE-2026-82910<\/td>renderLink compiles link parameters as FreeMarker source<\/td><\/tr>
Authenticated code execution<\/td>CVE-2026-82894<\/td>Content renderer runs a service name stored on the row<\/td><\/tr>
Authenticated code execution<\/td>CVE-2026-71901<\/td>Dispatch arbitrary internal services on SFA component<\/td><\/tr>
Authentication bypass \/ credentials<\/td>CVE-2026-105330<\/td>Use of Hard-coded Cryptographic Key in JWT Token Authentication Enables Unauthenticated Administrative Access<\/td><\/tr>
Authentication bypass \/ credentials<\/td>CVE-2026-92887<\/td>REST API authentication bypassed by default when the auth attribute is omitted from a .rest.xml operation<\/td><\/tr>
Authentication bypass \/ credentials<\/td>CVE-2026-109928<\/td>Incorrect Authentication Algorithm Implementation in Password Reset Enables Full Account Takeover<\/td><\/tr>
Authentication bypass \/ credentials<\/td>CVE-2026-82907<\/td>externalLoginKey honoured pre-auth, reusable and unbound<\/td><\/tr>
Authentication bypass \/ credentials<\/td>CVE-2026-97356<\/td>Insufficiently Protected Credentials in ViewFile Enable Authentication Bypass<\/td><\/tr>
Authentication bypass \/ credentials<\/td>CVE-2026-97355<\/td>Hard-coded Credentials in AdminServer Enable Unauthenticated Denial of Service<\/td><\/tr>
Authentication bypass \/ credentials<\/td>CVE-2026-84728<\/td>Cross-tenant authorization bypass in mapped-domain login<\/td><\/tr>
Authentication bypass \/ credentials<\/td>CVE-2026-114277<\/td>Janrain Engage Social Login Improperly Binds External Identities to Local Accounts<\/td><\/tr>
Unauthenticated view bypass \/ disclosure<\/td>CVE-2026-73577<\/td>Unauthenticated path-suffix view authorization bypass<\/td><\/tr>
Unauthenticated view bypass \/ disclosure<\/td>CVE-2026-73580<\/td>Unauthenticated HR organization and employee disclosure<\/td><\/tr>
Unauthenticated view bypass \/ disclosure<\/td>CVE-2026-83538<\/td>Unauthenticated disclosure through HR, Catalog, and Order Manager helpers<\/td><\/tr>
SQL injection<\/td>CVE-2026-81815<\/td>SQL injection – performFind ignore-case values, MySQL\/MariaDB<\/td><\/tr>
XML external entity<\/td>CVE-2026-81816<\/td>XML external entity injection (XXE)<\/td><\/tr>
SSRF \/ server-side fetch<\/td>CVE-2026-81828<\/td>Server-side request forgery in SurveyWrapper<\/td><\/tr>
SSRF \/ server-side fetch<\/td>CVE-2026-82902<\/td>Unfiltered server-side URL fetch in webtools viewdatafile<\/td><\/tr>
Path traversal \/ file write<\/td>CVE-2026-66903<\/td>Authenticated Path Traversal in Catalog Image Management<\/td><\/tr>
Path traversal \/ file write<\/td>CVE-2026-76150<\/td>Authenticated path traversal and missing authorization check in replaceImageToExistImage<\/td><\/tr>
Path traversal \/ file write<\/td>CVE-2026-76152<\/td>Authenticated path traversal and missing authorization check in imageCrop and imageRotate services<\/td><\/tr>
Path traversal \/ file write<\/td>CVE-2026-82916<\/td>webtools xmldsdump exports any entity to any path<\/td><\/tr>
Cross-site scripting<\/td>CVE-2026-114229<\/td>Reflected Cross-site Scripting in Catalog Image Viewer Enables Script Execution in a User Session<\/td><\/tr>
Denial of service<\/td>CVE-2026-74841<\/td>Denial of Service via unauthenticated userTenantId in multitenant mode<\/td><\/tr>
Denial of service<\/td>CVE-2026-82904<\/td>Unbounded multi-form row count from a parameter name<\/td><\/tr>
Missing authorization \/ business logic<\/td>CVE-2026-81734<\/td>Missing authorization – catalog quick-admin product writes<\/td><\/tr>
Missing authorization \/ business logic<\/td>CVE-2026-81744<\/td>Authorization bypass – self-grant content OWNER<\/td><\/tr>
Missing authorization \/ business logic<\/td>CVE-2026-81808<\/td>Missing authorization – search-result bulk catalog mutation<\/td><\/tr>
Missing authorization \/ business logic<\/td>CVE-2026-100168<\/td>Missing Authorization vulnerability<\/td><\/tr>
Missing authorization \/ business logic<\/td>CVE-2026-100228<\/td>Improper Input Validation in Order Returns Enables Unauthorized Refund Price Manipulation<\/td><\/tr>
Missing authorization \/ business logic<\/td>CVE-2026-105325<\/td>Missing authorization in payment application services allows view-only users to modify payment allocations<\/td><\/tr>
Missing authorization \/ business logic<\/td>CVE-2026-105461<\/td>Missing authorization in updateOrderItems allows view-only users to modify order prices and quantities<\/td><\/tr>
Missing authorization \/ business logic<\/td>CVE-2026-109129<\/td>Authorization Bypass Through User-Controlled Key in OrderServices Enables Unauthorized Payment Preference Modification<\/td><\/tr>
Missing authorization \/ business logic<\/td>CVE-2026-109837<\/td>Authorization Bypass Through User-Controlled Key in Order Returns Enables Cross-Party OrderItem Association<\/td><\/tr>
Missing authorization \/ business logic<\/td>CVE-2026-109856<\/td>Missing Authorization in Financial Account Services Enables Unauthorized Balance Manipulation<\/td><\/tr>
Missing authorization \/ business logic<\/td>CVE-2026-114233<\/td>Incorrect Privilege Assignment in Order Manager Enables Unauthorized Modification of Approved Orders<\/td><\/tr>
Missing authorization \/ business logic<\/td>CVE-2026-114235<\/td>Direct Request in Order Manager Enables Unauthorized Tracking Number Modification<\/td><\/tr>
Missing authorization \/ business logic<\/td>CVE-2026-114271<\/td>Authorization Bypass Through User-Controlled Key in Shopping Lists Enables Cross-Party Shopping List Modification<\/td><\/tr>
Missing authorization \/ business logic<\/td>CVE-2026-114272<\/td>Authorization Bypass Through User-Controlled Key in Content Viewing Enables Unauthorized Content Disclosure<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n

The largest group, 14 missing-authorization and business-logic flaws, matters more in an ERP than the label suggests. Several titles describe view-only users changing payment allocations, order prices, refund amounts or financial account balances.<\/p>\n\n\n\n

The four CVE records with published detail<\/h2>\n\n\n\n

We retrieved four of the 46 records from CVE.org. All were published on 5 November 2026 and none has a CVSS score or a CISA enrichment container.<\/p>\n\n\n\n

CVE-2026-105330: hard-coded JWT key (moderate)<\/h3>\n\n\n\n

A forged JWT signed with the factory-default security.token.key<\/code> gives an unauthenticated network attacker full administrative access<\/strong>. The conditions are narrow. The flaw applies to deployments that were upgraded from a release predating the earlier CVE-2026-31986 fix, kept their existing security.properties<\/code>, and have security.internal.sso.enabled<\/code> set to true. The record lists affected versions as 24.09.06 and 24.09.07.<\/p>\n\n\n\n

The important detail: upgrading alone does not replace a key that is already set.<\/strong> Affected deployments must also run .\/gradlew rotateSecretKeys<\/code>. Apache rates it “moderate” (CWE-321). Credit: L1nq (github.com\/L1nq0).<\/p>\n\n\n\n

CVE-2026-92887: REST API authentication off by default (important)<\/h3>\n\n\n\n

In OFBiz through 24.09.07, ModelApiReader<\/code> treats a missing auth<\/code> attribute in a .rest.xml<\/code> operation as false, although rest-api.xsd<\/code> defines the default as true. A remote unauthenticated attacker can therefore call those REST operations without credentials. Rated “important” (CWE-306, CWE-1188). Credit: Wanxin Yin (yaklang.io).<\/p>\n\n\n\n

CVE-2026-109928: password-reset token gives a full session (important)<\/h3>\n\n\n\n

In 24.09 before 24.09.08, an attacker who holds a user’s password-reset token can submit it to the login endpoint and get a full session, including an administrator session if the target is an admin. The record gives intercepted email, exposed logs and a man-in-the-middle on mail transport as ways a token might leak. Rated “important” (CWE-303). Credit: CyberLeo (Independent Security Researcher).<\/p>\n\n\n\n

CVE-2026-81815: SQL injection on MySQL\/MariaDB (important)<\/h3>\n\n\n\n

The generic performFind<\/code> service is affected on MySQL and MariaDB. A remote unauthenticated attacker sends an ignore-case find (for example _ic=Y<\/code>) with a crafted backslash-terminated value. SqlJdbcUtil.addValueSingle<\/code> escapes only single quotes, so the value breaks out of the string literal and turns the WHERE clause into a tautology, exposing arbitrary rows of the queried entity. The default Derby datasource and PostgreSQL are not affected. Rated “important” (CWE-89). Credits: n0mi1k (reporter) and Krishna Uprit (remediation developer).<\/p>\n\n\n\n

Ce que nous ne savons pas encore<\/h2>\n\n\n\n

Severity, CWE and credits for the other 42 CVEs had not been retrieved at the time of writing; the records for CVE-2026-68524 and CVE-2026-83542 were not yet available through the CVE.org API. So it is not yet confirmed which CVEs Apache rated “critical”. Treat the three titles describing unauthenticated RCE as the highest priority until the records say otherwise.<\/p>\n\n\n\n

We found no reports of in-the-wild exploitation<\/strong> et no CISA KEV listing<\/strong> for any of the 46. Searches turned up only aggregator pages about earlier 2026 OFBiz CVEs, such as CVE-2026-31986, CVE-2026-45434, CVE-2026-47342 and CVE-2026-50223.<\/p>\n\n\n\n

Why OFBiz batches get attention<\/h2>\n\n\n\n

OFBiz has a documented exploitation history:<\/p>\n\n\n\n