BlogPHP2Shell Exploitation: How Secure.com Can Protect YouRead more
← CVE Radar

CVE-2026-92887Apache OFBiz: REST API authentication bypassed by default when the auth attribute is omitted from a .rest.xml operation

Incorrect default value in the REST API framework's .rest.xml definition parser (ModelApiReader) in Apache OFBiz through 24.09.07 on all platforms allows a remote, unauthenticated attacker to invoke a REST API operation without providing valid credentials via a .rest.xml resource or operation definition that omits the auth attribute, which ModelApiReader incorrectly resolves to false instead of the true default declared by rest-api.xsd. Users are recommended to upgrade to version 24.09.08, which fixes this issue.

EPSS 0.22%Not in KEVNVD: Undergoing Analysis

OverviewAffected ProductsReferences
NVD CVE.org

Overview

Severity

No CVSS score has been published for CVE-2026-92887 yet.

Details

CVE ID
CVE-2026-92887
Status
Undergoing Analysis
Assigner (CNA)
apache
Published
Nov 5, 2026
Last modified
2026-11-05 14:48 UTC
Weaknesses
  • CWE-306 · Missing authentication for critical function
  • CWE-1188 · Initialization of a resource with an insecure default

Sources

Refreshed hourly from the sources above. Last fetched 2026-11-08 08:16 UTC.