Shodan
Vulnerabilities
Vulnerable Software

Vulnerability Details CVE-2026-83538

Missing Authorization in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote unauthenticated attacker to disclose internal business records — including organization, employee, product catalog, and product-store data — by requesting several helper endpoints across the Human Resources, Catalog, and Order Manager applications that are configured to skip authentication and perform no permission check before returning the requested record. Users are recommended to upgrade to version 24.09.08, which fixes this issue.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.003
EPSS Ranking 21.5%
CVSS Severity
CVSS v3 Score 5.3
Products affected by CVE-2026-83538
  • Apache » Ofbiz » Version: N/A
    cpe:2.3:a:apache:ofbiz:-
  • Apache » Ofbiz » Version: 09.04
    cpe:2.3:a:apache:ofbiz:09.04
  • Apache » Ofbiz » Version: 09.04.01
    cpe:2.3:a:apache:ofbiz:09.04.01
  • Apache » Ofbiz » Version: 10.04
    cpe:2.3:a:apache:ofbiz:10.04
  • Apache » Ofbiz » Version: 10.04.01
    cpe:2.3:a:apache:ofbiz:10.04.01
  • Apache » Ofbiz » Version: 10.04.02
    cpe:2.3:a:apache:ofbiz:10.04.02
  • Apache » Ofbiz » Version: 10.04.03
    cpe:2.3:a:apache:ofbiz:10.04.03
  • Apache » Ofbiz » Version: 10.04.04
    cpe:2.3:a:apache:ofbiz:10.04.04
  • Apache » Ofbiz » Version: 10.04.05
    cpe:2.3:a:apache:ofbiz:10.04.05
  • Apache » Ofbiz » Version: 10.04.06
    cpe:2.3:a:apache:ofbiz:10.04.06
  • Apache » Ofbiz » Version: 11.04
    cpe:2.3:a:apache:ofbiz:11.04
  • Apache » Ofbiz » Version: 11.04.01
    cpe:2.3:a:apache:ofbiz:11.04.01
  • Apache » Ofbiz » Version: 11.04.02
    cpe:2.3:a:apache:ofbiz:11.04.02
  • Apache » Ofbiz » Version: 11.04.03
    cpe:2.3:a:apache:ofbiz:11.04.03
  • Apache » Ofbiz » Version: 11.04.04
    cpe:2.3:a:apache:ofbiz:11.04.04
  • Apache » Ofbiz » Version: 11.04.05
    cpe:2.3:a:apache:ofbiz:11.04.05
  • Apache » Ofbiz » Version: 11.04.06
    cpe:2.3:a:apache:ofbiz:11.04.06
  • Apache » Ofbiz » Version: 12.04
    cpe:2.3:a:apache:ofbiz:12.04
  • Apache » Ofbiz » Version: 12.04.01
    cpe:2.3:a:apache:ofbiz:12.04.01
  • Apache » Ofbiz » Version: 12.04.02
    cpe:2.3:a:apache:ofbiz:12.04.02
  • Apache » Ofbiz » Version: 12.04.03
    cpe:2.3:a:apache:ofbiz:12.04.03
  • Apache » Ofbiz » Version: 12.04.04
    cpe:2.3:a:apache:ofbiz:12.04.04
  • Apache » Ofbiz » Version: 12.04.05
    cpe:2.3:a:apache:ofbiz:12.04.05
  • Apache » Ofbiz » Version: 12.04.06
    cpe:2.3:a:apache:ofbiz:12.04.06
  • Apache » Ofbiz » Version: 13.07
    cpe:2.3:a:apache:ofbiz:13.07
  • Apache » Ofbiz » Version: 13.07.01
    cpe:2.3:a:apache:ofbiz:13.07.01
  • Apache » Ofbiz » Version: 13.07.02
    cpe:2.3:a:apache:ofbiz:13.07.02
  • Apache » Ofbiz » Version: 13.07.03
    cpe:2.3:a:apache:ofbiz:13.07.03
  • Apache » Ofbiz » Version: 16.11.01
    cpe:2.3:a:apache:ofbiz:16.11.01
  • Apache » Ofbiz » Version: 16.11.02
    cpe:2.3:a:apache:ofbiz:16.11.02
  • Apache » Ofbiz » Version: 16.11.03
    cpe:2.3:a:apache:ofbiz:16.11.03
  • Apache » Ofbiz » Version: 16.11.04
    cpe:2.3:a:apache:ofbiz:16.11.04
  • Apache » Ofbiz » Version: 16.11.05
    cpe:2.3:a:apache:ofbiz:16.11.05
  • Apache » Ofbiz » Version: 16.11.06
    cpe:2.3:a:apache:ofbiz:16.11.06
  • Apache » Ofbiz » Version: 16.11.07
    cpe:2.3:a:apache:ofbiz:16.11.07
  • Apache » Ofbiz » Version: 17.12.01
    cpe:2.3:a:apache:ofbiz:17.12.01
  • Apache » Ofbiz » Version: 17.12.03
    cpe:2.3:a:apache:ofbiz:17.12.03
  • Apache » Ofbiz » Version: 17.12.04
    cpe:2.3:a:apache:ofbiz:17.12.04
  • Apache » Ofbiz » Version: 17.12.05
    cpe:2.3:a:apache:ofbiz:17.12.05
  • Apache » Ofbiz » Version: 17.12.06
    cpe:2.3:a:apache:ofbiz:17.12.06
  • Apache » Ofbiz » Version: 17.12.07
    cpe:2.3:a:apache:ofbiz:17.12.07
  • Apache » Ofbiz » Version: 17.12.08
    cpe:2.3:a:apache:ofbiz:17.12.08
  • Apache » Ofbiz » Version: 17.12.09
    cpe:2.3:a:apache:ofbiz:17.12.09
  • Apache » Ofbiz » Version: 18.12.01
    cpe:2.3:a:apache:ofbiz:18.12.01
  • Apache » Ofbiz » Version: 18.12.02
    cpe:2.3:a:apache:ofbiz:18.12.02
  • Apache » Ofbiz » Version: 18.12.03
    cpe:2.3:a:apache:ofbiz:18.12.03
  • Apache » Ofbiz » Version: 18.12.04
    cpe:2.3:a:apache:ofbiz:18.12.04
  • Apache » Ofbiz » Version: 18.12.05
    cpe:2.3:a:apache:ofbiz:18.12.05
  • Apache » Ofbiz » Version: 18.12.06
    cpe:2.3:a:apache:ofbiz:18.12.06
  • Apache » Ofbiz » Version: 18.12.07
    cpe:2.3:a:apache:ofbiz:18.12.07
  • Apache » Ofbiz » Version: 18.12.09
    cpe:2.3:a:apache:ofbiz:18.12.09
  • Apache » Ofbiz » Version: 18.12.10
    cpe:2.3:a:apache:ofbiz:18.12.10
  • Apache » Ofbiz » Version: 18.12.11
    cpe:2.3:a:apache:ofbiz:18.12.11
  • Apache » Ofbiz » Version: 18.12.12
    cpe:2.3:a:apache:ofbiz:18.12.12
  • Apache » Ofbiz » Version: 18.12.13
    cpe:2.3:a:apache:ofbiz:18.12.13
  • Apache » Ofbiz » Version: 18.12.14
    cpe:2.3:a:apache:ofbiz:18.12.14
  • Apache » Ofbiz » Version: 18.12.15
    cpe:2.3:a:apache:ofbiz:18.12.15
  • Apache » Ofbiz » Version: 18.12.16
    cpe:2.3:a:apache:ofbiz:18.12.16
  • Apache » Ofbiz » Version: 18.12.17
    cpe:2.3:a:apache:ofbiz:18.12.17
  • Apache » Ofbiz » Version: 18.12.19
    cpe:2.3:a:apache:ofbiz:18.12.19
  • Apache » Ofbiz » Version: 24.09.01
    cpe:2.3:a:apache:ofbiz:24.09.01
  • Apache » Ofbiz » Version: 24.09.02
    cpe:2.3:a:apache:ofbiz:24.09.02
  • Apache » Ofbiz » Version: 24.09.03
    cpe:2.3:a:apache:ofbiz:24.09.03
  • Apache » Ofbiz » Version: 24.09.04
    cpe:2.3:a:apache:ofbiz:24.09.04
  • Apache » Ofbiz » Version: 24.09.05
    cpe:2.3:a:apache:ofbiz:24.09.05
  • Apache » Ofbiz » Version: 24.09.06
    cpe:2.3:a:apache:ofbiz:24.09.06
  • Apache » Ofbiz » Version: 24.09.07
    cpe:2.3:a:apache:ofbiz:24.09.07
  • Apache » Ofbiz » Version: 9.04
    cpe:2.3:a:apache:ofbiz:9.04
  • Apache » Ofbiz » Version: 9.04.01
    cpe:2.3:a:apache:ofbiz:9.04.01
  • Apache » Ofbiz » Version: 9.04.02
    cpe:2.3:a:apache:ofbiz:9.04.02


Products
Pricing
Contact Us

Shodan ® - All rights reserved