Apache OFBiz up to 24.09.7 ContentWorker ContentWorker.renderContentAsText improper authorization

Summaryinfo

A vulnerability classified as critical was found in Apache OFBiz up to 24.09.7. This affects the function ContentWorker.renderContentAsText of the component ContentWorker. The manipulation results in improper authorization. This vulnerability is identified as CVE-2026-82894. The attack can be executed remotely. There is not any exploit available. Upgrading the affected component is advised.

Detailsinfo

A vulnerability was found in Apache OFBiz up to 24.09.7. It has been classified as critical. Affected is the function ContentWorker.renderContentAsText of the component ContentWorker. The manipulation with an unknown input leads to a improper authorization vulnerability. CWE is classifying the issue as CWE-285. The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

Improper Authorization in ContentWorker in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote unauthenticated attacker to trigger arbitrary OFBiz service invocation with attacker-controlled parameters, resulting in arbitrary file write, arbitrary file deletion, and server-side request forgery, by requesting the public showHelpPublic view against a Content row whose serviceName field an account holding only CONTENTMGR_CREATE or CONTENTMGR_UPDATE has set to an attacker-chosen service, causing ContentWorker.renderContentAsText to resolve the service to invoke from that persisted, client-writable field and build its parameters directly from the live HTTP request map with no allow-list, no ownership check, and no requirement that the caller be authenticated. Users are recommended to upgrade to version 24.09.08, which fixes this issue.

The advisory is available at lists.apache.org. This vulnerability is traded as CVE-2026-82894 since 08/31/2026. The exploitability is told to be easy. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. Technical details are known, but there is no available exploit. The structure of the vulnerability defines a possible price range of USD $0-$5k at the moment (estimation calculated on 11/05/2026). This vulnerability is assigned to T1548.002 by the MITRE ATT&CK project.

Upgrading to version 24.09.08 eliminates this vulnerability.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Vendor

• Apache

Name

• OFBiz

Version

• 24.09.0
• 24.09.1
• 24.09.2
• 24.09.3
• 24.09.4
• 24.09.5
• 24.09.6
• 24.09.7

License

• open-source

Website

• Vendor: https://www.apache.org/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion