CVE-2026-73580

Improper Authorization in ContentWorker in Apache OFBiz 24.09 before 24.09.08 allows a remote unauthenticated attacker to trigger arbitrary OFBiz service invocation with attacker-controlled parameters, resulting in arbitrary file write, arbitrary file deletion, and server-side request forgery, by requesting the public showHelpPublic view against a Content row whose serviceName field was set by an account holding only CONTENTMGR_CREATE or CONTENTMGR_UPDATE.

Server-Side Request Forgery in SurveyWrapper in Apache OFBiz 24.09 before 24.09.08 allows an authenticated back-office user with catalog permission to cause the server to fetch and render attacker-controlled URLs, including internal network and cloud-metadata endpoints and local files via file://, by setting an arbitrary URL as a product-store survey's template location; the fetched content is rendered into the HTTP response of shoppers loading the survey.

XML External Entity (XXE) Injection in ContentWorker in Apache OFBiz 24.09 before 24.09.08 allows a remote authenticated attacker holding content-author permission to read arbitrary server files and trigger server-side request forgery by storing a crafted text/xml DataResource containing an external entity declaration, which is parsed by FreeMarker's default NodeModel.parse DocumentBuilderFactory without secure processing or external-entity/DTD restrictions.

SQL Injection in the entity engine's generic performFind service in Apache OFBiz 24.09 before 24.09.08 on MySQL/MariaDB-backed deployments allows a remote unauthenticated attacker to disclose arbitrary rows by submitting an ignore-case find request (_ic=Y) with a crafted value, because SqlJdbcUtil.addValueSingle inlines the value using ANSI-only single-quote doubling, which is insufficient on MySQL/MariaDB where backslash escapes are honored.

Missing authorization in ProductSearchEvents in Apache OFBiz 24.09 before 24.09.08 allows an authenticated attacker with only catalog view permission to bulk-modify product category and feature associations via search-result mutation events. The servlet authorizes the request against only the base view-level permission while the underlying event methods perform writes without checking DELETE/CREATE permissions.

Incorrect authorization in ContentPermissionServices in Apache OFBiz 24.09 before 24.09.08 allows an authenticated attacker with limited content-create permission to self-grant the OWNER role on arbitrary content via the createContentRole service. The permission check falls through to a fail-open default-grant branch when no ContentPurposeOperation entry matches the requested operation.

Missing authorization in ProductEvents in Apache OFBiz 24.09 before 24.09.08 allows an authenticated attacker with only catalog view permission to create, modify, or remove product, feature association, and category association data by directly invoking catalog quick-admin events. The servlet authorizes the request against only the base view-level permission while the underlying event methods perform writes without checking update/create permissions.

Path traversal and missing authorization check in the imageCrop and imageRotate services in Apache OFBiz through 24.09.07 allows an authenticated attacker with only Catalog view permission to read arbitrary image-parseable files readable by the OFBiz process and to write a re-encoded image to an arbitrary directory writable by the OFBiz process via crafted productId and imageName parameters.

Path traversal and missing authorization check in the replaceImageToExistImage service in Apache OFBiz through 24.09.07 allows an authenticated attacker with only Catalog view permission to overwrite arbitrary files writable by the OFBiz process with JPEG-encoded content via crafted productId, dataResourceNameExist, and dataResourceNameReplace parameters.

In multitenant deployments, ContextFilter and LoginWorker built a per-tenant delegator name from a request-supplied userTenantId parameter and requested a delegator before confirming the tenant existed. DelegatorFactory's internal cache retains every delegator name, including ones that fail to resolve, so an unauthenticated attacker could submit a stream of arbitrary tenant IDs to grow this cache without bound.