CVE-2026-81734

Apache OFBiz versions 24.09 before 24.09.08 are vulnerable to a missing authorization flaw in the ProductEvents component. A remote authenticated attacker with only catalog view permissions can create, modify, or remove arbitrary product, product feature association, and product category associat...