Vulnerability · Published Nov 5, 2026 · Assigned by apache

CVE-2026-97356Apache OFBiz: Insufficiently Protected Credentials in ViewFile Enable Authentication Bypass

Unrated

In plain English

A security flaw in Apache OFBiz from Apache Software Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 9% of all known vulnerabilities).

Severity (CVSS )–Not rated

Exploit odds (30 days)0.2%top 91.3% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

External Control of File Name or Path vulnerability in the ViewFile component of Label Manager in Apache OFBiz 24.09.07 on all platforms allows an authenticated user holding only the LABEL_MANAGER_VIEW permission to read arbitrary properties and xml files on the server, including the generated JWT signing key, enabling forgery of an authenticated administrator session, via the fileName parameter of a ViewFile request. Users are recommended to upgrade to version 24.09.08, which fixes this issue.

Affected products (as reported)

Vendor	Product	Versions
Apache Software Foundation	Apache OFBiz	0 – before 24.09.08

Weakness: CWE-73

References

https://lists.apache.org/thread.html/7b2syzksp7klt9fvhdg0olldvs2g83lz vendor-advisory