https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-11-07T19:36:17.742634+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/cve-2026-100168 CVE-2026-100168 — Apache OFBiz: Missing Authorization vulnerability 2026-11-07T19:36:17.857768+00:00

Affected: Apache Software Foundation Apache OFBiz

Direct Request ('Forced Browsing') in the Content Manager component in Apache OFBiz 24.09.07 on all platforms allows an authenticated user holding only view-only content permissions (OFBTOOLS_VIEW and CONTENTMGR_VIEW) to re-parent content associations they do not own or manage via a direct POST request to the moveContentJson endpoint, which performs no permission check, unlike the equivalent updateContent/createContentAssoc/removeContentAssoc services that require genericContentPermission UPDATE. Users are recommended to upgrade to version 24.09.08, which fixes this issue.