CVE-2026-73578— Apache OFBiz: Unauthenticated saved-view authorization bypass with RCE impact
Quick assessment
Affected
Apache Software Foundation Apache OFBiz
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 Apache OFBiz 24.09（24.09.08 之前版本）的所有平台中， 方法缺少授权强制执行机制。这允许远程未认证攻击者通过提供精心构造的 值，绕过受保护视图的请求映射（request-map）认证策略。该值会被存储为匿名会话中的已保存视图状态，并在后续渲染时不再重新应用原始视图的认证要求，从而可能暴露受保护视图及其关联的业务数据。建议用户升级至 24.09.08 版本，该版本已修复此问题。
Possible ATT&CK Techniques 1 AI
T1530.002
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-73578
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Apache OFBiz: Unauthenticated saved-view authorization bypass with RCE impact
Source: CVE Program / CVE List V5
Vulnerability Description
Missing authorization enforcement in RequestHandler.renderView in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote unauthenticated attacker to bypass the request-map authentication policy for protected views by supplying a crafted _LAST_VIEW_NAME_ value, which is stored as saved-view state in the anonymous session and later rendered without re-applying the original view's authentication requirement, potentially exposing protected views and associated business data. Users are recommended to upgrade to version 24.09.08, which fixes this issue.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
使用候选路径或通道进行的认证绕过
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Apache Software Foundation | Apache OFBiz | 0 ~ 24.09.08 | - |
|
II. Public POCs for CVE-2026-73578
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-73578
请登录查看更多情报信息。
Other References for CVE-2026-73578 (1)
Same Patch Batch · Apache Software Foundation · 2026-11-05 · 58 CVEs total
| CVE-2026-73098 | 10.0 CRITICAL | Apache Juneau: Unsafe reflection allows attacker-controlled class initialization during pa |
| CVE-2026-73099 | 10.0 CRITICAL | Apache Juneau: Cross-site request forgery via default-enabled content query-parameter body |
| CVE-2026-73100 | 10.0 CRITICAL | Apache Juneau: Sensitive request headers logged in cleartext by the default request logger |
| CVE-2026-73101 | 10.0 CRITICAL | Apache Juneau: Internal exception class and message disclosed via error response header an |
| CVE-2026-73116 | 10.0 CRITICAL | Apache Juneau: REST client forwards credentials to a different origin when following HTTP |
| CVE-2026-73117 | 10.0 CRITICAL | Apache Juneau: Response header CRLF injection and open redirect when applications set head |
| CVE-2026-96677 | 10.0 CRITICAL | Apache Juneau: Cross-site scripting via unescaped request variables in HTML-doc chrome |
| CVE-2026-121489 | 10.0 CRITICAL | Apache Juneau: Path traversal in DirectoryResource allows reading files outside the config |
| CVE-2026-73095 | 8.7 HIGH | Apache Juneau: Denial of service via unbounded memory allocation in parsers and REST reque |
| CVE-2026-103864 | Apache Sling Engine: Request-derived values reach log sinks without CR/LF neutralization | |
| CVE-2026-97356 | Apache OFBiz: Insufficiently Protected Credentials in ViewFile Enable Authentication Bypas | |
| CVE-2026-109856 | Apache OFBiz: Missing Authorization in Financial Account Services Enables Unauthorized Bal | |
| CVE-2026-109837 | Apache OFBiz: Authorization Bypass Through User-Controlled Key in Order Returns Enables Cr | |
| CVE-2026-109129 | Apache OFBiz: Authorization Bypass Through User-Controlled Key in OrderServices Enables Un | |
| CVE-2026-105461 | Apache OFBiz: Missing authorization in updateOrderItems allows view-only users to modify o | |
| CVE-2026-105330 | Apache OFBiz: Use of Hard-coded Cryptographic Key in JWT Token Authentication Enables Unau | |
| CVE-2026-105325 | Apache OFBiz: Missing authorization in payment application services allows view-only users | |
| CVE-2026-100228 | Apache OFBiz: Improper Input Validation in Order Returns Enables Unauthorized Refund Price | |
| CVE-2026-100168 | Apache OFBiz: Missing Authorization vulnerability | |
| CVE-2026-97355 | Apache OFBiz: Hard-coded Credentials in AdminServer Enable Unauthenticated Denial of Servi |
Showing top 20 of 58 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: Apache OFBiz
-
CVE-2026-66903
Apache OFBiz: Authenticated Path Traversal in Catalog Image -
CVE-2026-71901
Apache OFBiz: Dispatch arbitrary internal services on SFA co -
CVE-2026-68524
Apache OFBiz: Pre-Authentication Remote Code Execution via A -
CVE-2026-73577
Apache OFBiz: Unauthenticated path-suffix view authorization -
CVE-2026-73580
Apache OFBiz: Unauthenticated HR organization and employee d
Same vendor: Apache Software Foundation
-
CVE-2026-66903
Apache OFBiz: Authenticated Path Traversal in Catalog Image -
CVE-2026-71901
Apache OFBiz: Dispatch arbitrary internal services on SFA co -
CVE-2026-68524
Apache OFBiz: Pre-Authentication Remote Code Execution via A -
CVE-2026-73577
Apache OFBiz: Unauthenticated path-suffix view authorization -
CVE-2026-73580
Apache OFBiz: Unauthenticated HR organization and employee d
Same weakness: CWE-288
-
CVE-2026-73577
Apache OFBiz: Unauthenticated path-suffix view authorization -
CVE-2026-52848
GLPI: MFA bypass -
CVE-2026-57775
WordPress Simple Cloudflare Turnstile plugin <= 1.44.1 - Bro -
CVE-2026-55186
Silverstripe MFA: Can bypass MFA during password reset flow -
CVE-2026-77799
Two-factor authentication bypass