CVE-2026-73580
— UNSCOREDPublished 2026-11-05 · Updated 2026-11-05
AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.
NVD description
Missing authorization check in the getHRChild service in Apache OFBiz through 24.09.07 on all platforms allows a remote unauthenticated attacker to recursively enumerate Human Resources organization and employee data, including department names and identifiers, employment position names and identifiers, employee party identifiers, position occupancy, and organization relationships, via a crafted partyId parameter. Users are recommended to upgrade to version 24.09.08, which fixes this issue.
Weaknesses
CWE-200, CWE-862
All references
Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.
Related CVEs
- UNSCOREDCVE-2026-103091PoC
- HIGHCVE-2026-105635PoC
- HIGHCVE-2026-107811PoC
- UNSCOREDCVE-2026-112192PoC
- UNSCOREDCVE-2026-112887PoC
- MEDIUMCVE-2026-113668PoC
- UNSCOREDCVE-2026-117649PoC
- HIGHCVE-2026-118759PoC
Related by shared AI tags and CWE weakness class. Browse the full archive.