Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Buy Us a Coffee

CVE-2026-84183— Apache OFBiz: Content Manager VIEW-only RCE in updateLayout

Quick assessment

Affected

Apache Software Foundation Apache OFBiz

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 Apache OFBiz 24.09（24.09.08 之前版本）的所有平台上，文件中的简单方法存在授权检查不当的漏洞。该漏洞允许仅持有和权限的远程已认证攻击者，以 OFBiz 进程用户的身份执行任意命令。攻击原理如下：方法的授权检查仅验证固定的操作权限，而未针对实际的内容记录（Content record）检查更新权限，也未对独立选择的数据资源（DataResource）进行相应授权校验。攻击者可利用此缺陷，将现有的用于目的的内容记录重新关联，并将任意独立选定的数据资源转换为指向 OFBiz

AI Predicted 8.8 Difficulty: Moderate Updated Nov 05, 2026

Possible ATT&CK Techniques 2 AI

T1068.002 T1190 · Exploit Public-Facing Application

Updated Nov 05, 2026

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Apache OFBiz: Content Manager VIEW-only RCE in updateLayout

Source: CVE Program / CVE List V5

Vulnerability Description

Incorrect Authorization in the updateLayout simple-method in applications/content/minilang/layout/LayoutEvents.xml in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote authenticated attacker holding only OFBTOOLS_VIEW and CONTENTMGR_VIEW to execute arbitrary commands as the OFBiz process user, by using updateLayout's authorization check — which validates only the fixed CONTENT_CREATE operation rather than an update permission on the actual Content record and an independently selected DataResource — to relink an existing RESPONSE-purpose Content record and convert an arbitrary, independently selected DataResource into an OFBIZ_FILE/FTL resource pointed at the OFBiz access log, poisoned via a crafted User-Agent header and evaluated through the normal authenticated showContent route. Users are recommended to upgrade to version 24.09.08, which fixes this issue.

Source: CVE Program / CVE List V5

CVSS Information

N/A

Source: CVE Program / CVE List V5

Vulnerability Type

授权机制不正确

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
Apache Software Foundation	Apache OFBiz	0 ~ 24.09.08	-

II. Public POCs for CVE-2026-84183

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-84183

请登录查看更多情报信息。

Other References for CVE-2026-84183 (1)

https://lists.apache.org/thread.html/7b2syzksp7klt9fvhdg0olldvs2g83lz vendor-advisory

https://www.cve.org/CVERecord?id=CVE-2026-84183

Same Patch Batch · Apache Software Foundation · 2026-11-05 · 58 CVEs total

CVE-2026-73098	10.0 CRITICAL	Apache Juneau: Unsafe reflection allows attacker-controlled class initialization during pa
CVE-2026-73099	10.0 CRITICAL	Apache Juneau: Cross-site request forgery via default-enabled content query-parameter body
CVE-2026-73100	10.0 CRITICAL	Apache Juneau: Sensitive request headers logged in cleartext by the default request logger
CVE-2026-73101	10.0 CRITICAL	Apache Juneau: Internal exception class and message disclosed via error response header an
CVE-2026-73116	10.0 CRITICAL	Apache Juneau: REST client forwards credentials to a different origin when following HTTP
CVE-2026-73117	10.0 CRITICAL	Apache Juneau: Response header CRLF injection and open redirect when applications set head
CVE-2026-96677	10.0 CRITICAL	Apache Juneau: Cross-site scripting via unescaped request variables in HTML-doc chrome
CVE-2026-121489	10.0 CRITICAL	Apache Juneau: Path traversal in DirectoryResource allows reading files outside the config
CVE-2026-73095	8.7 HIGH	Apache Juneau: Denial of service via unbounded memory allocation in parsers and REST reque
CVE-2026-103864		Apache Sling Engine: Request-derived values reach log sinks without CR/LF neutralization
CVE-2026-97356		Apache OFBiz: Insufficiently Protected Credentials in ViewFile Enable Authentication Bypas
CVE-2026-109856		Apache OFBiz: Missing Authorization in Financial Account Services Enables Unauthorized Bal
CVE-2026-109837		Apache OFBiz: Authorization Bypass Through User-Controlled Key in Order Returns Enables Cr
CVE-2026-109129		Apache OFBiz: Authorization Bypass Through User-Controlled Key in OrderServices Enables Un
CVE-2026-105461		Apache OFBiz: Missing authorization in updateOrderItems allows view-only users to modify o
CVE-2026-105330		Apache OFBiz: Use of Hard-coded Cryptographic Key in JWT Token Authentication Enables Unau
CVE-2026-105325		Apache OFBiz: Missing authorization in payment application services allows view-only users
CVE-2026-100228		Apache OFBiz: Improper Input Validation in Order Returns Enables Unauthorized Refund Price
CVE-2026-100168		Apache OFBiz: Missing Authorization vulnerability
CVE-2026-97355		Apache OFBiz: Hard-coded Credentials in AdminServer Enable Unauthenticated Denial of Servi

Showing top 20 of 58 CVEs. View all on vendor page → →

IV. Related Vulnerabilities

Same product: Apache OFBiz

Same vendor: Apache Software Foundation

Same weakness: CWE-863