CVE-2026-92887

Incorrect default value in the REST API framework's .rest.xml definition parser ModelApiReader in Apache OFBiz through 24.09.07 on all platforms allows a remote, unauthenticated attacker to invoke a REST API operation without providing valid credentials via a .rest.xml resource or operation...