CVE-2026-73577— Apache OFBiz: Unauthenticated path-suffix view authorization bypass
Quick assessment
Affected
Apache Software Foundation Apache OFBiz
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Apache OFBiz 24.09 版本（24.09.08 之前）在所有平台上的 RequestHandler 组件中存在授权缺陷。该漏洞允许远程未认证攻击者通过在公开请求路径末尾附加受保护视图的路径后缀（例如：/catalog/control/ListLocales/showPortalPage），从而绕过受保护视图的认证要求。此时，Servlet 会仅根据公开路径部分对请求进行授权，却渲染了受保护的后缀视图。建议用户升级至 24.09.08 版本，该版本已修复此问题。
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-73577
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Apache OFBiz: Unauthenticated path-suffix view authorization bypass
Source: CVE Program / CVE List V5
Vulnerability Description
Incorrect authorization in RequestHandler in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote unauthenticated attacker to bypass the authentication requirement of a protected view by appending it as a path suffix to a public request (e.g., /catalog/control/ListLocales/showPortalPage), causing the servlet to authorize the request based on the public path component while rendering the protected suffix view. Users are recommended to upgrade to version 24.09.08, which fixes this issue.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
使用候选路径或通道进行的认证绕过
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Apache Software Foundation | Apache OFBiz | 0 ~ 24.09.08 | - |
|
II. Public POCs for CVE-2026-73577
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-73577
请登录查看更多情报信息。
Other References for CVE-2026-73577 (1)
Same Patch Batch · Apache Software Foundation · 2026-11-05 · 58 CVEs total
| CVE-2026-73098 | 10.0 CRITICAL | Apache Juneau: Unsafe reflection allows attacker-controlled class initialization during pa |
| CVE-2026-73099 | 10.0 CRITICAL | Apache Juneau: Cross-site request forgery via default-enabled content query-parameter body |
| CVE-2026-73100 | 10.0 CRITICAL | Apache Juneau: Sensitive request headers logged in cleartext by the default request logger |
| CVE-2026-73101 | 10.0 CRITICAL | Apache Juneau: Internal exception class and message disclosed via error response header an |
| CVE-2026-73116 | 10.0 CRITICAL | Apache Juneau: REST client forwards credentials to a different origin when following HTTP |
| CVE-2026-73117 | 10.0 CRITICAL | Apache Juneau: Response header CRLF injection and open redirect when applications set head |
| CVE-2026-96677 | 10.0 CRITICAL | Apache Juneau: Cross-site scripting via unescaped request variables in HTML-doc chrome |
| CVE-2026-121489 | 10.0 CRITICAL | Apache Juneau: Path traversal in DirectoryResource allows reading files outside the config |
| CVE-2026-73095 | 8.7 HIGH | Apache Juneau: Denial of service via unbounded memory allocation in parsers and REST reque |
| CVE-2026-103864 | Apache Sling Engine: Request-derived values reach log sinks without CR/LF neutralization | |
| CVE-2026-97356 | Apache OFBiz: Insufficiently Protected Credentials in ViewFile Enable Authentication Bypas | |
| CVE-2026-109856 | Apache OFBiz: Missing Authorization in Financial Account Services Enables Unauthorized Bal | |
| CVE-2026-109837 | Apache OFBiz: Authorization Bypass Through User-Controlled Key in Order Returns Enables Cr | |
| CVE-2026-109129 | Apache OFBiz: Authorization Bypass Through User-Controlled Key in OrderServices Enables Un | |
| CVE-2026-105461 | Apache OFBiz: Missing authorization in updateOrderItems allows view-only users to modify o | |
| CVE-2026-105330 | Apache OFBiz: Use of Hard-coded Cryptographic Key in JWT Token Authentication Enables Unau | |
| CVE-2026-105325 | Apache OFBiz: Missing authorization in payment application services allows view-only users | |
| CVE-2026-100228 | Apache OFBiz: Improper Input Validation in Order Returns Enables Unauthorized Refund Price | |
| CVE-2026-100168 | Apache OFBiz: Missing Authorization vulnerability | |
| CVE-2026-97355 | Apache OFBiz: Hard-coded Credentials in AdminServer Enable Unauthenticated Denial of Servi |
Showing top 20 of 58 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: Apache OFBiz
-
CVE-2026-66903
Apache OFBiz: Authenticated Path Traversal in Catalog Image -
CVE-2026-71901
Apache OFBiz: Dispatch arbitrary internal services on SFA co -
CVE-2026-68524
Apache OFBiz: Pre-Authentication Remote Code Execution via A -
CVE-2026-73578
Apache OFBiz: Unauthenticated saved-view authorization bypas -
CVE-2026-73580
Apache OFBiz: Unauthenticated HR organization and employee d
Same vendor: Apache Software Foundation
-
CVE-2026-66903
Apache OFBiz: Authenticated Path Traversal in Catalog Image -
CVE-2026-71901
Apache OFBiz: Dispatch arbitrary internal services on SFA co -
CVE-2026-68524
Apache OFBiz: Pre-Authentication Remote Code Execution via A -
CVE-2026-73578
Apache OFBiz: Unauthenticated saved-view authorization bypas -
CVE-2026-73580
Apache OFBiz: Unauthenticated HR organization and employee d
Same weakness: CWE-288
-
CVE-2026-73578
Apache OFBiz: Unauthenticated saved-view authorization bypas -
CVE-2026-52848
GLPI: MFA bypass -
CVE-2026-57775
WordPress Simple Cloudflare Turnstile plugin <= 1.44.1 - Bro -
CVE-2026-55186
Silverstripe MFA: Can bypass MFA during password reset flow -
CVE-2026-77799
Two-factor authentication bypass