CVE-2026-84728

Incorrect Authorization in Apache OFBiz 24.09 before 24.09.08 on all platforms, when documented multitenancy is enabled, allows a remote authenticated attacker holding only a valid low-privilege account in one tenant to read and write data belonging to a different tenant, by submitting their own...

CVE-2026-84728 Apache OFBiz: Cross-tenant authorization bypass in mapped-domain login

Incorrect Authorization in Apache OFBiz 24.09 before 24.09.08 on all platforms, when documented multitenancy is enabled, allows a remote authenticated attacker holding only a valid low-privilege account in one tenant to read and write data belonging to a different tenant, by submitting their own...

CVE-2026-84728

Apache OFBiz versions 24.09 before 24.09.08 on all platforms are vulnerable to an Incorrect Authorization flaw when multitenancy is enabled. A remote authenticated attacker with low-privilege access to one tenant can read or write data from a different tenant. This occurs because the LoginWorker ...

EUVD-2026-117468

Incorrect Authorization in Apache OFBiz 24.09 before 24.09.08 on all platforms, when documented multitenancy is enabled, allows a remote authenticated attacker holding only a valid low-privilege account in one tenant to read and write data belonging to a different tenant, by submitting their own...

Code injection

In Apache OFBiz, versions 18.12.05 and earlier, an attacker acting as an anonymous user of the ecommerce plugin, can insert a malicious content in a message “Subject” field from the "Contact us" page. Then a party manager needs to list the communications in the party component to activate the SST...