Skip to content
OpenAdvisories
High WID-SEC-2026-1586 16 CVEs

Apache OFBiz: Mehrere Schwachstellen

Published May 18, 2026 · Updated May 19, 2026 · Revision 2 · de-DE

Vendor: Apache Product: OFBiz Platform: Windows

Summary

Ein Angreifer kann mehrere Schwachstellen in Apache OFBiz ausnutzen, um beliebigen Programmcode auszuführen, Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren, vertrauliche Informationen offenzulegen oder Cross-Site-Scripting-Angriffe durchzuführen.

Product

Apache OFBiz ist eine Suite von Unternehmensanwendungen und ein Framework zur Entwicklung weiterer Anwendungen.

Vulnerabilities 16

  • Critical 9.8
    CVE-2026-45434 EPSS 21%

    Apache OFBiz: Authentication Bypass via Password-Change Logic Flaw Leading to RCE

    Improper Authentication vulnerability in Apache OFBiz via Password-Change Logic Flaw Leading to Remote Code Execution This issue affects Apache OFBiz: before 24.09.06. Users are recommended to upgrade to version 24.09.06, which fixes the issue.

    Apache Software Foundation Apache OFBiz
  • Critical 9.1
    CVE-2026-31986

    Apache OFBiz: Unauthenticated RCE via Default JWT Signing Key and Widget Template Injection

    Use of Hard-coded Cryptographic Key vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 24.09.06. Users are recommended to upgrade to version 24.09.06, which fixes the issue.

    Apache Software Foundation Apache OFBiz
  • Critical 9.1
    CVE-2026-41919

    Apache OFBiz: Authentication Bypass due to Improper Neutralization of LDAP Special Elements in DN Construction

    Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 24.09.06. Users are recommended to upgrade to version 24.09.06, which fixes the issue.

    Apache Software Foundation Apache OFBiz
  • High 8.8
    CVE-2026-46586

    Apache OFBiz: Improper Validation in traverseContent Service Enables Authenticated Groovy Code Execution

    Improper Control of Generation of Code ('Code Injection'), Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 24.09.06. Users are recommended to upgrade…

    Apache Software Foundation Apache OFBiz
  • High 7.5
    CVE-2026-31909

    Apache OFBiz: Unauthenticated Shipment Label Image Disclosure

    Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 24.09.06. Users are recommended to upgrade to version 24.09.06, which fixes the issue.

    Apache Software Foundation Apache OFBiz
  • High 7.5
    CVE-2026-31910

    Apache OFBiz: Improper Input Validation in UI Factory Classes Leads to SSRF and Blind File Access

    Server-Side Request Forgery (SSRF) vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 24.09.06. Users are recommended to upgrade to version 24.09.06, which fixes the issue.

    Apache Software Foundation Apache OFBiz
  • High 7.3
    CVE-2026-29226

    Apache OFBiz: Low-Privilege SSRF in Content Component

    Server-Side Request Forgery (SSRF) vulnerability in Apache OFBiz via Content component operations. This issue affects Apache OFBiz: before 24.09.06. Users are recommended to upgrade to version 24.09.06, which fixes the issue.

    Apache Software Foundation Apache OFBiz
  • Medium 6.5
    CVE-2026-29220

    Apache OFBiz: Low-Privilege LFI in Content Component

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 24.09.06. Users are recommended to upgrade to version 24.09.06, which fixes the issue.

    Apache Software Foundation Apache OFBiz
  • Medium 6.5
    CVE-2026-31378

    Apache OFBiz: JSON Attribute Override and URL Allowlist Bypass Leads to Remote Code Execution

    Improper Input Validation vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 24.09.06. Users are recommended to upgrade to version 24.09.06, which fixes the issue.

    Apache Software Foundation Apache OFBiz
  • Medium 6.5
    CVE-2026-31380

    Apache OFBiz: FreeMarker SSTI via Duplicate Parameter Sanitization Bypass

    Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection') vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 24.09.06. Users are recommended to upgrade to version 24.09.06, which…

    Apache Software Foundation Apache OFBiz
  • Medium 6.5
    CVE-2026-35086

    Apache OFBiz: Authenticated Remote Code Execution via Unsafe Template Expansion in email services

    Improper Control of Generation of Code ('Code Injection') vulnerability in email services of Apache OFBiz. This issue affects Apache OFBiz: before 24.09.06. Users are recommended to upgrade to version 24.09.06, which fixes the issue.

    Apache Software Foundation Apache OFBiz
  • Medium 6.5
    CVE-2026-45187

    Apache OFBiz: Improper Authorization in Scheduled Job Creation Allows Low-Privileged Users to Submit System Jobs

    Improper Authorization vulnerability in Apache OFBiz Webtools. This issue affects Apache OFBiz: before 24.09.06. Users are recommended to upgrade to version 24.09.06, which fixes the issue.

    Apache Software Foundation Apache OFBiz
  • Medium 6.1
    CVE-2026-31379

    Apache OFBiz: Path Traversal and File Upload Validation Bypass Leading to Arbitrary File Write, Stored XSS and RCE in Catalog Manager

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'), Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), Improper Control of Generation of Code ('Code Injection') vulnerability in Apache OFBiz. This…

    Apache Software Foundation Apache OFBiz
  • Medium 6.1
    CVE-2026-31906

    Apache OFBiz: Reflected XSS via Improper HTML Attribute Escaping in Layered-Modal Dialog Parameters

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 24.09.06. Users are recommended to upgrade to version 24.09.06, which fixes the issue.

    Apache Software Foundation Apache OFBiz
  • Medium 5.3
    CVE-2026-31387

    Apache OFBiz: Cookie Manipulation Allows Authenticated JWT Forgery and Account Impersonation

    Improper Authentication vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 24.09.06. Users are recommended to upgrade to version 24.09.06, which fixes the issue.

    Apache Software Foundation Apache OFBiz
  • Medium 5.3
    CVE-2026-31388

    Apache OFBiz: Cross-Tenant Data Exposure via Program Export Feature

    Improper Access Control vulnerability in Apache OFBiz in multi-tenant deployments. This issue affects Apache OFBiz: before 24.09.06. Users are recommended to upgrade to version 24.09.06, which fixes the issue.

    Apache Software Foundation Apache OFBiz

Revision history

  1. #2

    CVE's ergänzt

  2. #1

    Initiale Fassung

References