Düşük
CVE-2026-100168: CVE-2026-100168: güvenlik açığı
Açıklama (NVD)
Direct Request ('Forced Browsing') in the Content Manager component in Apache OFBiz 24.09.07 on all platforms allows an authenticated user holding only view-only content permissions (OFBTOOLS_VIEW and CONTENTMGR_VIEW) to re-parent content associations they do not own or manage via a direct POST request to the moveContentJson endpoint, which performs no permission check, unlike the equivalent updateContent/createContentAssoc/removeContentAssoc services that require genericContentPermission UPDATE. Users are recommended to upgrade to version 24.09.08, which fixes this issue.
Özet bilgiler
- EPSS
- %0,18 (yüzdelik 8)
- CWE
- CWE-425
- Yama
- Yok / bilinmiyor