CVE-2026-81744

Apache OFBiz versions 24.09 before 24.09.08 are vulnerable to an authorization bypass in the ContentPermissionServices component. A remote authenticated attacker with limited content-create permissions can invoke the createContentRole service (e.g., via createForumGroupRole) to self-grant the OWN...