CVE-2026-84728

Name of the Vulnerable Software and Affected Versions Apache OFBiz versions 24.09 through 24.09.07

Description An authorization issue occurs when multitenancy is enabled, allowing a remote authenticated attacker with a low-privilege account in one tenant to read and write data from another tenant. The attacker can achieve this by providing their own userTenantId parameter and credentials during the Party Manager login process while targeting a hostname mapped to a different tenant. This happens because the LoginWorker function() prioritizes the userTenantId request parameter over the tenant resolved by the ContextFilter via TenantDomainName. Consequently, subsequent requests use the attacker's session identity and security object for permission checks but execute read or write operations against the data of the tenant associated with the hostname.

Recommendations Upgrade to version 24.09.08.