PT-2026-137510

CVE-2026-83538

Published

2026-11-05

Updated

2026-11-05

Description by

CVSS 3.1

5.3

Medium

MetricsAV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Apache OFBiz versions 24.09 through 24.09.07

Description Missing authorization across the Human Resources, Catalog, and Order Manager applications allows a remote unauthenticated attacker to disclose internal business records, such as organization, employee, product catalog, and product-store data. This occurs because several helper endpoints are configured to skip authentication and perform no permission checks before returning the requested records.

Recommendations Upgrade to version 24.09.08.

Exploitability

Fix

Impacts

Researchers

Jonah Burgess

Krishna Uprit

Vendors

Affected products

Weakness enumeration

CWE-862: Missing Authorization

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor