Read the docs
TI-2026-85406 Aliases CVE-2026-92887GHSA-8p9x-6h8h-hghw

Authentication bypass by default in Apache OFBiz REST API

Priority LOW 22CWE-1188Published · Updated

Key facts

Attack vector
—
Privileges required
—
User interaction
—
Attack complexity
—
Impact type
Security bypass
Confidentiality · integrity · availability
—
Fix status
Fixed

No CVSS vector from any source. Fix status from CNA. Impact type from CWE-306.

Summary

Apache OFBiz through 24.09.07 on all platforms has an incorrect default in its REST API framework. The ModelApiReader parser resolves an omitted auth attribute in a .rest.xml definition to false instead of the true default, which is a missing authentication flaw (CWE-306). A remote unauthenticated attacker can invoke a REST API operation without providing valid credentials.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Description from the CNA

Incorrect default value in the REST API framework's .rest.xml definition parser (ModelApiReader) in Apache OFBiz through 24.09.07 on all platforms allows a remote, unauthenticated attacker to invoke a REST API operation without providing valid credentials via a .rest.xml resource or operation definition that omits the auth attribute, which ModelApiReader incorrectly resolves to false instead of the true default declared by rest-api.xsd. Users are recommended to upgrade to version 24.09.08, which fixes this issue.

Why it matters now

EPSS 0.00225 13th percentileScored 2026-11-07
Fix Fixed Apache OFBiz (Apache Software Foundation): 24.09.08

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
ApacheApache OFBizbefore 24.09.0824.09.08Patch availableCNA
  • Apache OFBiz VendorApache Affected before 24.09.08 Fixed in 24.09.08 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:apache:ofbiz:*:*:*:*:*:*:*:*——Apache
  • cpe:2.3:a:apache:ofbiz:*:*:*:*:*:*:*:* Versions — — ·Apache

Remediation

Upgrade Apache OFBiz to version 24.09.08, which fixes this issue.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

  • Fix · CNA Apache OFBiz (Apache Software Foundation) Fixed in 24.09.08

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Advisory ·

    Apache OFBiz — lists.apache.org/thread.html/7b2syzksp7klt9fvhdg0olldvs2g83…

    46 records Highest priority Priority MEDIUM 7 MEDIUM, 39 LOW

    Other records, highest priority first

    • TI-2026-85437 Code injection in Apache OFBiz lets unauthenticated attackers run codePriority MEDIUM 51
    • TI-2026-85431 Authentication bypass in Apache OFBiz through reusable login keysPriority MEDIUM 50
    • TI-2026-85438 Incorrect authorization in Apache OFBiz lets attackers run commandsPriority MEDIUM 42
    Show all 46 records → Advisory →

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-11-05 Threatist record created from CVE-2026-92887
  2. 2026-11-05 Alias added: GHSA-8p9x-6h8h-hghw
  3. 2026-11-06 Affected versions changed · Red Hat
  4. 2026-11-06 CVSS score added · Red Hat

References

Advisory 1

  • TI-2025-18529 Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT KEVCVSS 3.1CRITICAL 10.0
  • TI-2024-30292 Apache OFBiz: Confused controller-view authorization logic (forced browsing) KEVCVSS 3.1CRITICAL 9.8
  • TI-2024-26062 Apache OFBiz: Unauthenticated endpoint could allow execution of screen rendering code KEVCVSS 3.1CRITICAL 9.8
  • TI-2024-21190 Apache OFBiz: Path traversal leading to RCE KEVCVSS 3.1CRITICAL 9.8
  • TI-2024-18186 Apache HugeGraph-Server: Command execution in gremlin KEVCVSS 3.1CRITICAL 9.8
  • TI-2023-25106 Deserialization of untrusted data in Apache ActiveMQ KEVCVSS 3.1CRITICAL 10.0
See all 4053 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences