CVE-2026-73580

Missing authorization check in the getHRChild service in Apache OFBiz through 24.09.07 on all platforms allows a remote unauthenticated attacker to recursively enumerate Human Resources organization and employee data, including department names and identifiers, employment position names and...

CVE-2026-73580

Apache OFBiz versions through 24.09.07 on all platforms are vulnerable to an unauthenticated remote disclosure of Human Resources data. A missing authorization check in the getHRChild service allows an attacker to recursively enumerate sensitive information, including department names, identifier...

EUVD-2026-117490

Missing authorization check in the getHRChild service in Apache OFBiz through 24.09.07 on all platforms allows a remote unauthenticated attacker to recursively enumerate Human Resources organization and employee data, including department names and identifiers, employment position names and...