Dashboard / CVE-2026-73577

CVE-2026-73577

1 PoC
INFO Priority: 0.00 BB Relevance: 10/100
Published: 2026-11-05 Modified: 2026-11-06 First seen: 2026-11-05 Status: pending_score

Description

Incorrect authorization in RequestHandler in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote unauthenticated attacker to bypass the authentication requirement of a protected view by appending it as a path suffix to a public request (e.g., /catalog/control/ListLocales/showPortalPage), causing the servlet to authorize the request based on the public path component while rendering the protected suffix view. Users are recommended to upgrade to version 24.09.08, which fixes this issue.

Weakness Classification (1)

Affected Software (1)

VendorProductVersion
Apache Software Foundation Apache OFBiz 0 < 24.09.08

References & Advisories (1)

Proof of Concept (1)

★ 1
https://github.com/Crypto-Cat/apache-ofbiz-2026-pocs
nomi-sec

Bug Bounty Relevance

10 / 100
✓ PoC available (1)

CVSS Score

Unscored

EPSS — Exploitation Probability

0.30%
Raw Score 0.002990
Percentile 22.7%
Date 2026-11-07

EPSS Trend

2026-11-07
0.00299
2026-11-06
0.00299

Intelligence Sources

mitre ref →
nvd ref →

External Links