BlogPHP2Shell Exploitation: How Secure.com Can Protect YouRead more
← CVE Radar

CVE-2026-100168Apache OFBiz: Missing Authorization vulnerability

Direct Request ('Forced Browsing') in the Content Manager component in Apache OFBiz 24.09.07 on all platforms allows an authenticated user holding only view-only content permissions (OFBTOOLS_VIEW and CONTENTMGR_VIEW) to re-parent content associations they do not own or manage via a direct POST request to the moveContentJson endpoint, which performs no permission check, unlike the equivalent updateContent/createContentAssoc/removeContentAssoc services that require genericContentPermission UPDATE. Users are recommended to upgrade to version 24.09.08, which fixes this issue.

EPSS 0.18%Not in KEVNVD: Awaiting Analysis

OverviewAffected ProductsReferences
NVD CVE.org

Overview

Severity

No CVSS score has been published for CVE-2026-100168 yet.

Details

CVE ID
CVE-2026-100168
Status
Awaiting Analysis
Assigner (CNA)
apache
Published
Nov 5, 2026
Last modified
2026-11-05 14:48 UTC
Weaknesses
  • CWE-425 · Direct request ('forced browsing')

Sources

Refreshed hourly from the sources above. Last fetched 2026-11-09 09:16 UTC.