CVE-2026-82916

Missing Authorization in XmlDsDump in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote authenticated attacker holding only the webtools base permissions OFBTOOLSVIEW, WEBTOOLSVIEW — explicitly not the ENTITYMAINT permission the export feature declares and visibly refuses to...