CVE-2026-47342: high-severity vulnerability in Apache OFBiz
Apache OFBiz: Privilege Escalation via updateOrRemove Authorization Bypass
Published · Updated
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 8.8epss 0.6%
from disclosure to weapon0 days
Published on NVDJun 10
1st PoCMay 27
exploitation probability
0.6%top 54% of all CVEs
observed exploitation
nono source reports it
1 public exploit(s)
A privilege escalation vulnerability in Apache OFBiz allows a low-privileged authenticated user to obtain higher privileges
This issue affects Apache OFBiz: before 24.09.07.
Users are recommended to upgrade to version 24.09.07, which fixes the issue.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected products
Apache Software Foundation · Apache OFBizpublic PoCs found — 1
githubgithub.com/lwd3c/CVE-2026-47342★ 0⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Apache OFBiz
In the same product, most dangerous first.
CVE-2024-45195CRITICALApache OFBiz: Confused controller-view authorization logic (forced browsing)EPSS 100.0%KEVCVE-2024-32113CRITICALApache OFBiz: Path traversal leading to RCEEPSS 99.9%KEVCVE-2024-38856HIGHApache OFBiz: Unauthenticated endpoint could allow execution of screen rendering codeEPSS 99.4%KEVCVE-2021-26295—RCE vulnerability in latest Apache OFBiz due to Java serialisation using RMIEPSS 97.8%CVE-2023-51467—Apache OFBiz: Pre-authentication Remote Code Execution (RCE) vulnerabilityEPSS 96.0%CVE-2023-49070—Pre-auth RCE in Apache Ofbiz 18.12.09 due to XML-RPC still presentEPSS 95.4%