CVE-2026-47342: Apache OFBiz: Privilege Escalation via updateOrRemove Authorization Bypass

Synopsis

An authorization bypass enabling privilege escalation affects Apache OFBiz versions before 24.09.07. The vulnerability is reachable over the network and requires only a low-privileged authenticated account, with no victim interaction needed. Successful exploitation grants the attacker full read, write, and availability control over the affected OFBiz instance. A patched-image rebuild at version 24.09.07 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable endpoint is exposed over the network, so the attacker must be able to reach the OFBiz service across the network to exploit this vulnerability.

• AuthenticationRequired

  Any low-privilege account is sufficient; the attacker does not need admin credentials, but must hold at least a basic authenticated session in OFBiz.

• Victim interactionNot required

  No victim interaction is needed; the attacker can exploit the authorization bypass entirely on their own without requiring another user to take any action.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, specific memory layouts, or other variable environmental factors.

Blast Radius

• A successful attacker escalates their privileges and gains full read access to application data, including user records, order data, and any other information stored in OFBiz.
• The attacker can write or modify persisted data in OFBiz, including business records, user accounts, and configuration, enabling tampering or backdoor account creation.
• The attacker can disrupt availability of the OFBiz service, including triggering conditions that crash or destabilize the application for all users.