Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Buy Us a Coffee

CVE-2026-71901— Apache OFBiz: Dispatch arbitrary internal services on SFA component

Quick assessment

Affected

Apache Software Foundation Apache OFBiz

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Apache OFBiz 中存在资源标识符控制不当（“资源注入”）漏洞。已认证且拥有 sfa 组件访问权限的用户，可以覆盖在 vCard 导入时所使用的服务，从而访问其他服务。此漏洞影响 Apache OFBiz 24.09.08 之前的所有版本。建议用户升级至 24.09.08 版本，该版本已修复此问题。

AI Predicted 6.5 Difficulty: Moderate Updated Nov 05, 2026

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Updated Nov 05, 2026

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Apache OFBiz: Dispatch arbitrary internal services on SFA component

Source: CVE Program / CVE List V5

Vulnerability Description

Improper Control of Resource Identifiers ('Resource Injection') vulnerability in Apache OFBiz. An authenticate user with access to sfa component can override the service to use on vcard import and access to other service. This issue affects Apache OFBiz: before 24.09.08. Users are recommended to upgrade to version 24.09.08, which fixes the issue.

Source: CVE Program / CVE List V5

CVSS Information

N/A

Source: CVE Program / CVE List V5

Vulnerability Type

对资源描述符的控制不恰当(资源注入)

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
Apache Software Foundation	Apache OFBiz	0 ~ 24.09.08	-

II. Public POCs for CVE-2026-71901

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-71901

请登录查看更多情报信息。

Other References for CVE-2026-71901 (1)

https://lists.apache.org/thread.html/7b2syzksp7klt9fvhdg0olldvs2g83lz vendor-advisory

https://www.cve.org/CVERecord?id=CVE-2026-71901

Same Patch Batch · Apache Software Foundation · 2026-11-05 · 58 CVEs total

CVE-2026-73098	10.0 CRITICAL	Apache Juneau: Unsafe reflection allows attacker-controlled class initialization during pa
CVE-2026-73099	10.0 CRITICAL	Apache Juneau: Cross-site request forgery via default-enabled content query-parameter body
CVE-2026-73100	10.0 CRITICAL	Apache Juneau: Sensitive request headers logged in cleartext by the default request logger
CVE-2026-73101	10.0 CRITICAL	Apache Juneau: Internal exception class and message disclosed via error response header an
CVE-2026-73116	10.0 CRITICAL	Apache Juneau: REST client forwards credentials to a different origin when following HTTP
CVE-2026-73117	10.0 CRITICAL	Apache Juneau: Response header CRLF injection and open redirect when applications set head
CVE-2026-96677	10.0 CRITICAL	Apache Juneau: Cross-site scripting via unescaped request variables in HTML-doc chrome
CVE-2026-121489	10.0 CRITICAL	Apache Juneau: Path traversal in DirectoryResource allows reading files outside the config
CVE-2026-73095	8.7 HIGH	Apache Juneau: Denial of service via unbounded memory allocation in parsers and REST reque
CVE-2026-103864		Apache Sling Engine: Request-derived values reach log sinks without CR/LF neutralization
CVE-2026-97356		Apache OFBiz: Insufficiently Protected Credentials in ViewFile Enable Authentication Bypas
CVE-2026-109856		Apache OFBiz: Missing Authorization in Financial Account Services Enables Unauthorized Bal
CVE-2026-109837		Apache OFBiz: Authorization Bypass Through User-Controlled Key in Order Returns Enables Cr
CVE-2026-109129		Apache OFBiz: Authorization Bypass Through User-Controlled Key in OrderServices Enables Un
CVE-2026-105461		Apache OFBiz: Missing authorization in updateOrderItems allows view-only users to modify o
CVE-2026-105330		Apache OFBiz: Use of Hard-coded Cryptographic Key in JWT Token Authentication Enables Unau
CVE-2026-105325		Apache OFBiz: Missing authorization in payment application services allows view-only users
CVE-2026-100228		Apache OFBiz: Improper Input Validation in Order Returns Enables Unauthorized Refund Price
CVE-2026-100168		Apache OFBiz: Missing Authorization vulnerability
CVE-2026-97355		Apache OFBiz: Hard-coded Credentials in AdminServer Enable Unauthenticated Denial of Servi

Showing top 20 of 58 CVEs. View all on vendor page → →

IV. Related Vulnerabilities

Same product: Apache OFBiz

Same vendor: Apache Software Foundation

Same weakness: CWE-99