CVE-2026-71901: Apache OFBiz: Dispatch arbitrary internal services on SFA component

Published Nov 5, 2026

Updated

Improper Control of Resource Identifiers ('Resource Injection') vulnerability in Apache OFBiz.

An authenticate user with access to sfa component can override the service to use on vcard import and access to other service.

This issue affects Apache OFBiz: before 24.09.08.

Users are recommended to upgrade to version 24.09.08, which fixes the issue.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Apache OFBiz to a version that resolves this vulnerability.
Fixed in 24.09.08

Event History

Nov 5, 2026

CVE Published

via MITRE·02:12 PM

Data Sourced

via MITRE·02:12 PM

DescriptionWeakness

Data Sourced

via NVD·03:17 PM

DescriptionWeakness

Frequently Asked Questions

Who can exploit this issue?

An attacker must be an authenticated Apache OFBiz user and must have access to the SFA component. The issue is not described as exploitable by unauthenticated users.

What access does successful exploitation provide?

A qualifying user can override the service used during vCard import and invoke other internal services. The available impact depends on which services the user can reach through that behavior.

Which versions need remediation?

Apache OFBiz versions before 24.09.08 are affected. Upgrade to version 24.09.08 to obtain the fix.

CVE-2026-71901: Apache OFBiz: Dispatch arbitrary internal services on SFA component

Remediation

Event History

Frequently Asked Questions

Who can exploit this issue?

What access does successful exploitation provide?

Which versions need remediation?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What access does successful exploitation provide?

Which versions need remediation?