CVE-2026-92887 Apache OFBiz: REST API authentication bypassed by default when the auth attribute is omitted from a .rest.xml operation

Incorrect default value in the REST API framework's .rest.xml definition parser ModelApiReader in Apache OFBiz through 24.09.07 on all platforms allows a remote, unauthenticated attacker to invoke a REST API operation without providing valid credentials via a .rest.xml resource or operation...