Loading vulnerability…
Missing Authorization in Apache OFBiz Content Manager moveContentJson
CVE-2026-100168 is a missing authorization vulnerability in the Content Manager component of Apache OFBiz 24.09.07 on all platforms. The moveContentJson endpoint accepts direct POST requests without checking content-update permissions, allowing authenticated users holding only OFBTOOLS_VIEW and CONTENTMGR_VIEW permissions to re-parent content associations they neither own nor manage. Unlike the equivalent updateContent, createContentAssoc, and removeContentAssoc services, the endpoint does not enforce genericContentPermission UPDATE. Apache OFBiz 24.09.08 fixes the vulnerability.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Authenticated view-only users can make unauthorized changes to content association hierarchies, compromising content integrity and bypassing ownership and management restrictions.
If you can’t patch tonight, do this now.
No vendor-specified interim workaround is identified. As a temporary compensating control, restrict access to the moveContentJson endpoint to users authorized to update content until the upgrade is completed.
Patch, then assume compromise.
Upgrade Apache OFBiz to version 24.09.08, which fixes the missing authorization check.
No public exploits tracked yet. Mallory keeps watching.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.