← CVE Radar
CVE-2026-73578Apache OFBiz: Unauthenticated saved-view authorization bypass with RCE impact
Missing authorization enforcement in RequestHandler.renderView in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote unauthenticated attacker to bypass the request-map authentication policy for protected views by supplying a crafted _LAST_VIEW_NAME_ value, which is stored as saved-view state in the anonymous session and later rendered without re-applying the original view's authentication requirement, potentially exposing protected views and associated business data. Users are recommended to upgrade to version 24.09.08, which fixes this issue.
EPSS 0.33%Not in KEVNVD: Awaiting Analysis
Overview
Severity
No CVSS score has been published for CVE-2026-73578 yet.
Details
- CVE ID
- CVE-2026-73578
- Status
- Awaiting Analysis
- Assigner (CNA)
- apache
- Published
- Nov 5, 2026
- Last modified
- 2026-11-06 21:36 UTC
- Weaknesses
- CWE-288 · Authentication bypass using an alternate path or channel
Affected Products
As published by the CNA in the CVE record.
Apache Software FoundationApache OFBiz1 version range
- before 24.09.08