PatchTheCVECVE-2026-73577: Incorrect authorization in RequestHandler in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remo
CVE-2026-73577 is a high-severity flaw (CVSS n/a) affecting apache ofbiz. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
Incorrect authorization in RequestHandler in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote unauthenticated attacker to bypass the authentication requirement of a protected view by appending it as a path suffix to a public request (e.g., /catalog/control/ListLocales/showPortalPage), causing the servlet to authorize the request based on the public path component while rendering the protected suffix view. Users are recommended
Why this priority
- On your watchlist
A fixed release or distro patch exists.
Risk facts
| CVSS score | n/a (High) |
| EPSS exploit chance | n/a |
| CISA exploited list | No |
| Weakness | CWE-288 |
| Published | 2026-11-05 |
| Last modified | 2026-11-05 |
Last updated 2026-11-05 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2026-73577?
apache ofbiz: upgrade to 24.09.08. Exact commands for each OS are on this page.
Is CVE-2026-73577 being exploited?
CVE-2026-73577 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2026-73577 affect?
CVE-2026-73577 affects apache ofbiz. Severity is high (CVSS n/a). Incorrect authorization in RequestHandler in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote unauthenticated attacker to bypass the authentication requirement of a protected view by appending it as a path suffix to a pub
How urgent is CVE-2026-73577?
Priority 5/100. On your watchlist
Related CVEs
- CVE-2026-66903 HIGH n/a UPGRADE Authenticated Path Traversal in Catalog Image Management allows writing image files outside the intended direc
- CVE-2026-71901 HIGH n/a UPGRADE Improper Control of Resource Identifiers ('Resource Injection') vulnerability in Apache OFBiz. An authentic
- CVE-2026-68524 HIGH n/a UPGRADE An unauthenticated attacker can exploit temporary-file handling, access an open file descriptor, and inject a
- CVE-2026-73578 HIGH n/a UPGRADE Missing authorization enforcement in RequestHandler.renderView in Apache OFBiz 24.09 before 24.09.08 on all pl
- CVE-2026-73580 HIGH n/a UPGRADE Missing authorization check in the getHRChild service in Apache OFBiz through 24.09.07 on all platforms allows