CVE-2026-92887 in OFBiz
Summary
by MITRE • 11/05/2026
Incorrect default value in the REST API framework's .rest.xml definition parser (ModelApiReader) in Apache OFBiz through 24.09.07 on all platforms allows a remote, unauthenticated attacker to invoke a REST API operation without providing valid credentials via a .rest.xml resource or operation definition that omits the auth attribute, which ModelApiReader incorrectly resolves to false instead of the true default declared by rest-api.xsd.
Users are recommended to upgrade to version 24.09.08, which fixes this issue.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 11/05/2026
The vulnerability identified in Apache OFBiz versions through 24.09.07 stems from a critical misconfiguration within the REST API framework's configuration parsing logic, specifically located in the ModelApiReader component responsible for processing .rest.xml definition files. This flaw represents an incorrect default value assignment that fundamentally alters the security posture of exposed services. The core technical issue arises when a developer defines a REST resource or operation without explicitly specifying the auth attribute within the XML structure. According to the rest-api.xsd schema, which serves as the authoritative validation standard for these definitions, the absence of this attribute should logically imply an authentication requirement by defaulting to true. However, due to a coding error in ModelApiReader, the system incorrectly resolves this missing value to false. This discrepancy creates a significant gap between the intended security policy defined by the schema and the actual runtime behavior enforced by the application logic.
From an operational perspective, this misconfiguration allows remote, unauthenticated attackers to invoke REST API operations that were presumed to be protected. Because the framework interprets the lack of explicit authentication requirements as permission for public access, sensitive endpoints become accessible without valid credentials. This effectively bypasses any intended security controls designed to restrict access based on user identity or role-based permissions. The impact is severe because it exposes internal business logic and data manipulation capabilities to the open internet. Attackers can exploit this flaw to perform unauthorized actions such as creating, modifying, or deleting records within the OFBiz database, potentially leading to data integrity compromise, information disclosure, or further system compromise depending on the specific operations exposed through these misconfigured endpoints.
This vulnerability aligns with CWE-284, which describes Improper Access Control, specifically where a security-critical configuration is set incorrectly by default. It also relates to CWE-16, Configuration, as the root cause lies in the failure of the application's initialization logic to adhere to its own defined schema constraints. In terms of offensive cybersecurity frameworks, this flaw facilitates initial access and privilege escalation within the context of web applications, mapping closely to MITRE ATT&CK techniques involving exploitation of misconfigured resources or services that lack proper authentication enforcement. The severity is amplified by the fact that it affects all platforms running the vulnerable versions, making a broad range of deployments susceptible if they rely on default configurations for their REST API definitions.
To mitigate this risk, organizations must immediately upgrade Apache OFBiz to version 24.09.08 or later, where the ModelApiReader logic has been corrected to properly respect the schema-defined defaults. For environments that cannot be upgraded instantly, a temporary mitigation involves auditing all .rest.xml files for any resource or operation definitions that omit the auth attribute and explicitly setting it to true in those instances. This manual correction ensures that the runtime behavior matches the intended security model until the software patch is applied. Regular configuration audits against schema standards are recommended to prevent similar discrepancies between declared policies and actual enforcement mechanisms in future development cycles.