CVE-2026-84183

Name of the Vulnerable Software and Affected Versions Apache OFBiz versions 24.09 through 24.09.07

Description Incorrect authorization in the updateLayout simple-method within applications/content/minilang/layout/LayoutEvents.xml allows a remote authenticated attacker with OFBTOOLS VIEW and CONTENTMGR VIEW permissions to execute arbitrary commands as the OFBiz process user. The issue occurs because the authorization check validates only the CONTENT CREATE operation instead of verifying update permissions on the specific Content record and the selected DataResource. An attacker can relink a RESPONSE-purpose Content record and convert a DataResource into an OFBIZ FILE/FTL resource. By poisoning the OFBiz access log via a crafted User-Agent header and accessing it through the showContent route, the attacker can achieve remote code execution.

Recommendations Upgrade to version 24.09.08.