CVE-2026-73578

Missing authorization enforcement in RequestHandler.renderView in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote unauthenticated attacker to bypass the request-map authentication policy for protected views by supplying a crafted LASTVIEWNAME value, which is stored as saved-vi...

CVE-2026-73578

Apache OFBiz versions 24.09 before 24.09.08 on all platforms are vulnerable to an authorization bypass in the RequestHandler.renderView component. A remote unauthenticated attacker can bypass request-map authentication policies for protected views by providing a crafted _LAST_VIEW_NAME_ value. Th...

EUVD-2026-117491

Missing authorization enforcement in RequestHandler.renderView in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote unauthenticated attacker to bypass the request-map authentication policy for protected views by supplying a crafted LASTVIEWNAME value, which is stored as saved-vi...