CVE-2026-73578

Apache OFBiz versions 24.09 before 24.09.08 on all platforms are vulnerable to an authorization bypass in the RequestHandler.renderView component. A remote unauthenticated attacker can bypass request-map authentication policies for protected views by providing a crafted _LAST_VIEW_NAME_ value. Th...