https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-11-08T10:36:53.828852+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/cve-2026-92887 CVE-2026-92887 — Apache OFBiz: REST API authentication bypassed by default when the auth attribute is omitted from a .rest.xml operation 2026-11-08T10:36:53.841138+00:00

Affected: Apache Software Foundation Apache OFBiz

Incorrect default value in the REST API framework's .rest.xml definition parser (ModelApiReader) in Apache OFBiz through 24.09.07 on all platforms allows a remote, unauthenticated attacker to invoke a REST API operation without providing valid credentials via a .rest.xml resource or operation definition that omits the auth attribute, which ModelApiReader incorrectly resolves to false instead of the true default declared by rest-api.xsd.

Users are recommended to upgrade to version 24.09.08, which fixes this issue.