Loading vulnerability…
Missing authorization in Apache OFBiz ProductSearchEvents bulk catalog mutations
CVE-2026-81808 is a missing authorization vulnerability in ProductSearchEvents in Apache OFBiz 24.09 releases before 24.09.08 on all platforms. The servlet authorizes search-result mutation requests using only the base view-level permission declared on the request-map. Event methods including searchRemoveFromCategory, searchExpireFromCategory, searchAddToCategory, searchAddFeature, and searchRemoveFeature then perform bulk entity-engine mutations without enforcing the CREATE or DELETE permissions required by equivalent service-layer operations such as removeProductFromCategory. An authenticated user with only catalog view permission can seed a broad product search and invoke these events to modify category and feature associations across the resulting products.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
A view-only catalog user can compromise catalog data integrity through unauthorized bulk addition, removal, or expiration of product category associations and addition or removal of product feature associations. The changes can affect arbitrary product search results rather than being limited to a single product.
Patch, then assume compromise.
Upgrade Apache OFBiz to version 24.09.08, which fixes the authorization vulnerability.
No public exploits tracked yet. Mallory keeps watching.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.