CVE-2026-84183

Summary

A misconfigured authorization check in Apache OFBiz's updateLayout method allows an authenticated attacker with low-privilege roles (OFBTOOLS_VIEW and CONTENTMGR_VIEW) to relink arbitrary data resources as FreeMarker templates, enabling remote code execution via crafted User-Agent headers logged into the access log.

Exploitability

Exploitation requires a valid OFBiz account with only OFBTOOLS_VIEW and CONTENTMGR_VIEW permissions; no additional privileges or external access are needed.

Blast radius

Successful exploitation grants the attacker full control over the OFBiz process user, enabling full system compromise including data theft, service disruption, and lateral movement.

Detection

Monitor access logs for entries containing User-Agent strings with FreeMarker syntax (e.g., ${...}) or suspicious template directives, followed by subsequent HTTP requests that trigger rendering of the affected content via showContent; also watch for unexpected changes to Content records linking RESPONSE-type content to OFBIZ_FILE/FTL data resources.

Prioritized remediation

Upgrade to Apache OFBiz version 24.09.08 immediately, which contains the official fix for this issue.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.