CVE-2026-92887: Apache OFBiz: REST API authentication bypassed by default when the auth attribute is omitted from a .rest.xml operation

Published Nov 5, 2026

Updated

Incorrect default value in the REST API framework's .rest.xml definition parser (ModelApiReader) in Apache OFBiz through 24.09.07 on all platforms allows a remote, unauthenticated attacker to invoke a REST API operation without providing valid credentials via a .rest.xml resource or operation definition that omits the auth attribute, which ModelApiReader incorrectly resolves to false instead of the true default declared by rest-api.xsd.

Users are recommended to upgrade to version 24.09.08, which fixes this issue.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Apache OFBiz to a version that resolves this vulnerability.
Fixed in 24.09.08

Event History

Nov 5, 2026

CVE Published

via MITRE·01:45 PM

Data Sourced

via MITRE·01:45 PM

DescriptionWeakness

Data Sourced

via NVD·02:17 PM

DescriptionWeakness

Frequently Asked Questions

Who is exposed to this issue?

Apache OFBiz deployments through 24.09.07 are exposed if they have REST API resources or operations defined in .rest.xml files where the auth attribute is omitted. The issue is remotely exploitable without authentication.

What must an attacker have to exploit it?

An attacker needs network access to an affected OFBiz REST API endpoint backed by a .rest.xml resource or operation definition that omits the auth attribute. No valid credentials are required for the affected operation.

How can I determine whether my deployment is affected?

Check whether the OFBiz version is 24.09.07 or earlier, then review deployed .rest.xml resource and operation definitions for omitted auth attributes. Those omissions can cause the parser to treat authentication as disabled.

What is the recommended remediation?

Upgrade Apache OFBiz to version 24.09.08, which fixes the incorrect default handling. Until upgrading, explicitly set the auth attribute for REST API resources and operations rather than leaving it omitted.

CVE-2026-92887: Apache OFBiz: REST API authentication bypassed by default when the auth attribute is omitted from a .rest.xml operation

Remediation

Event History

Frequently Asked Questions

Who is exposed to this issue?

What must an attacker have to exploit it?

How can I determine whether my deployment is affected?

What is the recommended remediation?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What must an attacker have to exploit it?

How can I determine whether my deployment is affected?

What is the recommended remediation?