CVE-2026-84183: Apache OFBiz: Content Manager VIEW-only RCE in updateLayout
Incorrect Authorization in the updateLayout simple-method in applications/content/minilang/layout/LayoutEvents.xml in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote authenticated attacker holding only OFBTOOLSVIEW and CONTENTMGRVIEW to execute arbitrary commands as the OFBiz process user, by using updateLayout's authorization check — which validates only the fixed CONTENTCREATE operation rather than an update permission on the actual Content record and an independently selected DataResource — to relink an existing RESPONSE-purpose Content record and convert an arbitrary, independently selected DataResource into an OFBIZFILE/FTL resource pointed at the OFBiz access log, poisoned via a crafted User-Agent header and evaluated through the normal authenticated showContent route. Users are recommended to upgrade to version 24.09.08, which fixes this issue.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache OFBizto a version that resolves this vulnerability.Fixed in 24.09.08
Event History
Frequently Asked Questions
Which deployments are affected?
Apache OFBiz 24.09 releases before 24.09.08 are affected on all platforms. The issue is in the Content Manager updateLayout simple-method.
What access does an attacker need?
An attacker must be remotely authenticated and hold only the OFBTOOLS_VIEW and CONTENTMGR_VIEW permissions. No user interaction is required.
What is the impact of successful exploitation?
An attacker can execute arbitrary commands as the OFBiz process user. This can affect confidentiality, integrity, and availability.
How does exploitation occur?
The attacker abuses updateLayout's fixed CONTENT_CREATE authorization check to relink a RESPONSE-purpose Content record and change an independently selected DataResource into an OFBIZ_FILE/FTL resource. A crafted User-Agent header can poison the OFBiz access log, which is then evaluated through the authenticated showContent route.
What is the recommended remediation?
Upgrade Apache OFBiz to version 24.09.08, which fixes the issue.