CVE-2026-84183 in OFBiz
Summary
by MITRE • 11/05/2026
Incorrect Authorization in the updateLayout simple-method in applications/content/minilang/layout/LayoutEvents.xml in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote authenticated attacker holding only OFBTOOLS_VIEW and CONTENTMGR_VIEW to execute arbitrary commands as the OFBiz process user, by using updateLayout's authorization check — which validates only the fixed CONTENT_CREATE operation rather than an update permission on the actual Content record and an independently selected DataResource — to relink an existing RESPONSE-purpose Content record and convert an arbitrary, independently selected DataResource into an OFBIZ_FILE/FTL resource pointed at the OFBiz access log, poisoned via a crafted User-Agent header and evaluated through the normal authenticated showContent route. Users are recommended to upgrade to version 24.09.08, which fixes this issue.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 11/05/2026
The vulnerability identified in Apache OFBiz versions prior to 24.09.08 represents a critical failure in authorization logic within the updateLayout method located in applications/content/minilang/layout/LayoutEvents.xml. This flaw allows remote authenticated attackers who possess only minimal permissions, specifically OFBTOOLS_VIEW and CONTENTMGR_VIEW, to escalate their privileges significantly. The core technical issue stems from an insufficient check of access rights during layout updates. Instead of validating that the user has permission to modify the specific Content record being updated or the DataResource being linked, the system performs a static authorization check against the fixed operation type CONTENT_CREATE. This logic error creates a bypass mechanism where users can manipulate internal configurations without holding the necessary elevated privileges typically required for such actions.
The operational impact of this vulnerability is severe, as it enables arbitrary command execution on the underlying server infrastructure running the OFBiz process. An attacker exploits this flaw by relinking an existing Content record designated with the RESPONSE purpose to point toward a DataResource that they have independently selected and controlled. By leveraging the application's logging mechanisms, specifically through crafting malicious User-Agent headers, attackers can poison the OFBiz access log files. These poisoned logs are then referenced as FTL (FreeMarker Template Language) resources within the layout configuration. When an authenticated user triggers the normal showContent route to display content, the system processes the template file containing the injected payload, resulting in the execution of arbitrary commands with the privileges of the OFBiz application process account.
This attack vector aligns closely with CWE-269, which describes Improper Privilege Management, as it involves an actor performing actions beyond their authorized level due to flawed access control checks. Furthermore, the exploitation technique maps to MITRE ATT&CK techniques related to Command and Scripting Interpreter abuse, specifically leveraging server-side template injection or file inclusion vulnerabilities to achieve remote code execution. The reliance on log poisoning via User-Agent headers also reflects common patterns seen in CWE-94, Improper Control of Generation of Code (Code Injection), where user-controllable input is used to inject malicious logic into a context that gets executed by the application server.
To mitigate this risk, organizations running Apache OFBiz must upgrade immediately to version 24.09.08 or later, which corrects the authorization checks within the updateLayout method to properly validate permissions against both the Content record and the associated DataResource. In addition to upgrading, administrators should enforce strict input validation on User-Agent headers if log poisoning remains a concern in other contexts, although this specific vulnerability is resolved by fixing the permission logic rather than just sanitizing inputs. Regular auditing of layout configurations and monitoring for unexpected changes to FTL resource links can also provide early detection indicators for similar exploitation attempts in legacy systems that have not yet been patched.