CVE-2026-83538
— UNSCOREDPublished 2026-11-05 · Updated 2026-11-05
AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.
NVD description
Missing Authorization in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote unauthenticated attacker to disclose internal business records — including organization, employee, product catalog, and product-store data — by requesting several helper endpoints across the Human Resources, Catalog, and Order Manager applications that are configured to skip authentication and perform no permission check before returning the requested record. Users are recommended to upgrade to version 24.09.08, which fixes this issue.
Weaknesses
CWE-200, CWE-862
All references
Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.
Related CVEs
- UNSCOREDCVE-2026-103091PoC
- HIGHCVE-2026-105635PoC
- HIGHCVE-2026-107811PoC
- UNSCOREDCVE-2026-112192PoC
- UNSCOREDCVE-2026-112887PoC
- MEDIUMCVE-2026-113668PoC
- UNSCOREDCVE-2026-117649PoC
- HIGHCVE-2026-118759PoC
Related by shared AI tags and CWE weakness class. Browse the full archive.