PatchTheCVECVE-2026-71901: Improper Control of Resource Identifiers ('Resource Injection') vulnerability in Apache OFBiz. An authentic
CVE-2026-71901 is a high-severity flaw (CVSS n/a) affecting apache ofbiz. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
Improper Control of Resource Identifiers ('Resource Injection') vulnerability in Apache OFBiz. An authenticate user with access to sfa component can override the service to use on vcard import and access to other service. This issue affects Apache OFBiz: before 24.09.08. Users are recommended to upgrade to version 24.09.08, which fixes the issue.
Why this priority
- On your watchlist
A fixed release or distro patch exists.
Risk facts
| CVSS score | n/a (High) |
| EPSS exploit chance | n/a |
| CISA exploited list | No |
| Weakness | CWE-99 |
| Published | 2026-11-05 |
| Last modified | 2026-11-05 |
Last updated 2026-11-05 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2026-71901?
apache ofbiz: upgrade to 24.09.08. Exact commands for each OS are on this page.
Is CVE-2026-71901 being exploited?
CVE-2026-71901 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2026-71901 affect?
CVE-2026-71901 affects apache ofbiz. Severity is high (CVSS n/a). Improper Control of Resource Identifiers ('Resource Injection') vulnerability in Apache OFBiz. An authenticate user with access to sfa component can override the service to use on vcard import and access to other service. This issue a
How urgent is CVE-2026-71901?
Priority 5/100. On your watchlist
Related CVEs
- CVE-2026-66903 HIGH n/a UPGRADE Authenticated Path Traversal in Catalog Image Management allows writing image files outside the intended direc
- CVE-2026-68524 HIGH n/a UPGRADE An unauthenticated attacker can exploit temporary-file handling, access an open file descriptor, and inject a
- CVE-2026-73577 HIGH n/a UPGRADE Incorrect authorization in RequestHandler in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remo
- CVE-2026-73578 HIGH n/a UPGRADE Missing authorization enforcement in RequestHandler.renderView in Apache OFBiz 24.09 before 24.09.08 on all pl
- CVE-2026-73580 HIGH n/a UPGRADE Missing authorization check in the getHRChild service in Apache OFBiz through 24.09.07 on all platforms allows