CVE-2026-83538
Apache OFBiz: Unauthenticated disclosure through HR, Catalog, and Order Manager helpers
Missing Authorization in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote unauthenticated attacker to disclose internal business records — including organization, employee, product catalog, and product-store data — by requesting several helper endpoints across the Human Resources, Catalog, and Order Manager applications that are configured to skip authentication and perform no permission check before returning the requested record. Users are recommended to upgrade to version 24.09.08, which fixes this issue.
Exploit likelihood
What each source reports
CVE List No score
Apache OFBiz: Unauthenticated disclosure through HR, Catalog, and Order Manager helpers
Missing Authorization in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote unauthenticated attacker to disclose internal business records — including organization, employee, product catalog, and product-store data — by requesting several helper endpoints across the Human Resources, Catalog, and Order Manager applications that are configured to skip authentication and perform no permission check before returning the requested record. Users are recommended to upgrade to version 24.09.08, which fixes this issue.
- Record
CVE-2026-83538- Weakness
- CWE-862, CWE-200
- Updated
- 2026-11-05
EUVDEUVD-2026-117472 No score
Missing Authorization in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote unauthenticated attacker to disclose internal business records — including organization, employee, product catalog, and product-store data — by requesting several helper endpoints across the Human Resources, Catalog, and Order Manager applications that are configured to skip authentication and perform no permission check before returning the requested record. Users are recommended to upgrade to version 24.09.08, which fixes this issue.
- Record
EUVD-2026-117472- Updated
- 2026-11-05
GitHub AdvisoriesGHSA-x974-v464-v25m No score
Missing Authorization in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote...
Missing Authorization in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote unauthenticated attacker to disclose internal business records — including organization, employee, product catalog, and product-store data — by requesting several helper endpoints across the Human Resources, Catalog, and Order Manager applications that are configured to skip authentication and perform no permission check before returning the requested record. Users are recommended to upgrade to version 24.09.08, which fixes this issue.
- Record
GHSA-x974-v464-v25m- Weakness
- CWE-200
- Updated
- 2026-11-05
NVD No score
Missing Authorization in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote unauthenticated attacker to disclose internal business records — including organization, employee, product catalog, and product-store data — by requesting several helper endpoints across the Human Resources, Catalog, and Order Manager applications that are configured to skip authentication and perform no permission check before returning the requested record. Users are recommended to upgrade to version 24.09.08, which fixes this issue.
- Record
CVE-2026-83538- Weakness
- CWE-200, CWE-862
- Updated
- 2026-11-05
Affected products
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-83538 is a vulnerability with no CVSS score yet in Apache Software Foundation Ofbiz, published November 5, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.29%, the 21st percentile. No source names a fixed version.