CVE-2026-84183

Incorrect Authorization in the updateLayout simple-method in applications/content/minilang/layout/LayoutEvents.xml in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote authenticated attacker holding only OFBTOOLSVIEW and CONTENTMGRVIEW to execute arbitrary commands as the OFBiz...

EUVD-2026-117469

Incorrect Authorization in the updateLayout simple-method in applications/content/minilang/layout/LayoutEvents.xml in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote authenticated attacker holding only OFBTOOLSVIEW and CONTENTMGRVIEW to execute arbitrary commands as the OFBiz...

CVE-2026-84183

Apache OFBiz version 24.09 before 24.09.08 is vulnerable to Incorrect Authorization in the updateLayout simple-method located in applications/content/minilang/layout/LayoutEvents.xml. A remote authenticated attacker with OFBTOOLS_VIEW and CONTENTMGR_VIEW privileges can execute arbitrary commands ...

CVE-2026-84183 Apache OFBiz: Content Manager VIEW-only RCE in updateLayout

Incorrect Authorization in the updateLayout simple-method in applications/content/minilang/layout/LayoutEvents.xml in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote authenticated attacker holding only OFBTOOLSVIEW and CONTENTMGRVIEW to execute arbitrary commands as the OFBiz...