CVE-2026-47342— Apache OFBiz: Privilege Escalation via updateOrRemove Authorization Bypass
Affected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Apache Software Foundation | Apache OFBiz | < 24.09.07 | affected |
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-47342
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Apache OFBiz: Privilege Escalation via updateOrRemove Authorization Bypass
Source: NVD (National Vulnerability Database)
Vulnerability Description
A privilege escalation vulnerability in Apache OFBiz allows a low-privileged authenticated user to obtain higher privileges This issue affects Apache OFBiz: before 24.09.07. Users are recommended to upgrade to version 24.09.07, which fixes the issue.
Source: NVD (National Vulnerability Database)
CVSS Information
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Type
授权机制不恰当
Source: NVD (National Vulnerability Database)
Vulnerability Title
Apache OFBiz 授权问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Apache OFBiz是美国阿帕奇（Apache）基金会的一套企业资源计划（ERP）系统。该系统提供了一整套基于Java的Web应用程序组件和工具。 Apache OFBiz 24.09.07之前版本存在授权问题漏洞，该漏洞源于权限提升问题，可能导致低权限认证用户获得更高权限。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Apache Software Foundation | Apache OFBiz | 0 ~ 24.09.07 | - |
II. Public POCs for CVE-2026-47342
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-47342
请登录查看更多情报信息。
Mailing List Discussions for CVE-2026-47342 (1)
Same Patch Batch · Apache Software Foundation · 2026-06-10 · 3 CVEs total
| CVE-2026-50223 | Apache OFBiz: DataResource Low-Privileged Authenticated FreeMarker Template Injection Lead | |
| CVE-2026-25700 | Apache Answer: AdminToken not invalidated after admin deactivation |
IV. Related Vulnerabilities
Same product: Apache OFBiz
- CVE-2026-50223
Apache OFBiz: DataResource Low-Privileged Authenticated Free - CVE-2026-46586
Apache OFBiz: Improper Validation in traverseContent Service - CVE-2026-45434
Apache OFBiz: Authentication Bypass via Password-Change Logi - CVE-2026-45187
Apache OFBiz: Improper Authorization in Scheduled Job Creati - CVE-2026-41919
Apache OFBiz: Authentication Bypass due to Improper Neutrali
Same vendor: Apache Software Foundation
- CVE-2026-50645
Apache CXF: No restriction on attachment headers per message - CVE-2026-50634
Apache CXF: WS JSON request filter trusts metadata from an u - CVE-2026-50633
Apache CXF: JNDI Injection vulnerability in DispatchMDBMessa - CVE-2026-50632
Apache CXF: JNDI Injection Vulnerability in JMSConfigFactory - CVE-2026-50631
Apache CXF: OAuth2: TOCTOU Race Condition in Refresh Token P
Same weakness: CWE-285
- CVE-2026-12213
hcengineering Huly Platform User Information operations.ts g - CVE-2026-46668
SpiceDB: Caveat structures with nested lists can result in i - CVE-2026-47298
Microsoft SharePoint Server Remote Code Execution Vulnerabil - CVE-2026-45503
Microsoft Exchange Server Information Disclosure Vulnerabili - CVE-2026-45490
.NET SDK Elevation of Privilege Vulnerability
V. Comments for CVE-2026-47342
No comments yet