{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-84728", "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "state": "PUBLISHED", "assignerShortName": "apache", "dateReserved": "2026-09-02T06:05:49.271Z", "datePublished": "2026-11-05T13:57:02.134Z", "dateUpdated": "2026-11-05T15:52:11.192Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache", "dateUpdated": "2026-11-05T13:57:02.134Z"}, "title": "Apache OFBiz: Cross-tenant authorization bypass in mapped-domain login", "problemTypes": [{"descriptions": [{"description": "CWE-863 Incorrect Authorization", "lang": "en", "cweId": "CWE-863", "type": "CWE"}]}], "source": {"discovery": "EXTERNAL"}, "affected": [{"vendor": "Apache Software Foundation", "product": "Apache OFBiz", "versions": [{"status": "affected", "version": "0", "lessThan": "24.09.08", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"value": "Incorrect Authorization in Apache OFBiz \n24.09 before 24.09.08 on all platforms, when documented multitenancy is \nenabled, allows a remote authenticated attacker holding only a valid \nlow-privilege account in one tenant to read and write data belonging to a\n different tenant, by submitting their own tenant's userTenantId \nalongside their own credentials to the normal Party Manager login \nagainst a hostname mapped to a different tenant: ContextFilter resolves \nthe tenant from the hostname via TenantDomainName, but LoginWorker gives\n priority to the conflicting userTenantId request parameter and \nauthenticates against the attacker's own tenant, so a subsequent \nordinary request to the same hostname combines the hostname-mapped \ntenant's Entity Engine delegator with the attacker's tenant's session \ndispatcher, security object, and identity, letting the permission check \nrun against the attacker's own tenant while the resulting read or write \nis performed against the hostname-mapped tenant's data. Users are \nrecommended to upgrade to version 24.09.08, which fixes this issue.", "lang": "en", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<span></span>Incorrect Authorization in Apache OFBiz \n24.09 before 24.09.08 on all platforms, when documented multitenancy is \nenabled, allows a remote authenticated attacker holding only a valid \nlow-privilege account in one tenant to read and write data belonging to a\n different tenant, by submitting their own tenant's userTenantId \nalongside their own credentials to the normal Party Manager login \nagainst a hostname mapped to a different tenant: ContextFilter resolves \nthe tenant from the hostname via TenantDomainName, but LoginWorker gives\n priority to the conflicting userTenantId request parameter and \nauthenticates against the attacker's own tenant, so a subsequent \nordinary request to the same hostname combines the hostname-mapped \ntenant's Entity Engine delegator with the attacker's tenant's session \ndispatcher, security object, and identity, letting the permission check \nrun against the attacker's own tenant while the resulting read or write \nis performed against the hostname-mapped tenant's data. Users are \nrecommended to upgrade to version 24.09.08, which fixes this issue.<span></span>"}]}], "references": [{"url": "https://lists.apache.org/thread.html/7b2syzksp7klt9fvhdg0olldvs2g83lz", "tags": ["vendor-advisory"]}], "metrics": [{"other": {"type": "Textual description of severity", "content": {"text": "important"}}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "credits": [{"lang": "en", "value": "Jonah Burgess (CryptoCat)", "type": "reporter"}, {"lang": "en", "value": "Krishna Uprit", "type": "remediation developer"}], "x_generator": {"engine": "Vulnogram 1.0.3"}}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-11-05T15:50:52.995671Z", "id": "CVE-2026-84728", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-05T15:52:11.192Z"}}]}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Apache OFBiz", "vendor": "Apache Software Foundation", "versions": [{"lessThan": "24.09.08", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@apache.org"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Incorrect Authorization in Apache OFBiz \n24.09 before 24.09.08 on all platforms, when documented multitenancy is \nenabled, allows a remote authenticated attacker holding only a valid \nlow-privilege account in one tenant to read and write data belonging to a\n different tenant, by submitting their own tenant's userTenantId \nalongside their own credentials to the normal Party Manager login \nagainst a hostname mapped to a different tenant: ContextFilter resolves \nthe tenant from the hostname via TenantDomainName, but LoginWorker gives\n priority to the conflicting userTenantId request parameter and \nauthenticates against the attacker's own tenant, so a subsequent \nordinary request to the same hostname combines the hostname-mapped \ntenant's Entity Engine delegator with the attacker's tenant's session \ndispatcher, security object, and identity, letting the permission check \nrun against the attacker's own tenant while the resulting read or write \nis performed against the hostname-mapped tenant's data. Users are \nrecommended to upgrade to version 24.09.08, which fixes this issue."}], "id": "CVE-2026-84728", "lastModified": "2026-11-05T14:48:26.210", "metrics": {}, "published": "2026-11-05T14:17:07.090", "references": [{"source": "security@apache.org", "url": "https://lists.apache.org/thread.html/7b2syzksp7klt9fvhdg0olldvs2g83lz"}], "sourceIdentifier": "security@apache.org", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-863"}], "source": "security@apache.org", "type": "Primary"}]}

{}

{}