PT-2026-137478

CVE-2026-92887

·

Published

2026-11-05

·

Updated

2026-11-05

Description by

Score
N/A
Not available

No severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.

Incorrect default value in the REST API framework's .rest.xml definition parser (ModelApiReader) in Apache OFBiz through 24.09.07 on all platforms allows a remote, unauthenticated attacker to invoke a REST API operation without providing valid credentials via a .rest.xml resource or operation definition that omits the auth attribute, which ModelApiReader incorrectly resolves to false instead of the true default declared by rest-api.xsd.
Users are recommended to upgrade to version 24.09.08, which fixes this issue.
Impacts
Researchers
Vendors
Affected products
Weakness enumeration
CWE-1188: Initialization of a Resource with an Insecure Default
CWE-306: Missing Authentication for Critical Function
Related identifiers
CVE-2026-92887
Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com