{"affected":[{"defaultStatus":"unaffected","product":"Apache OFBiz","source":"CNA: apache","vendor":"Apache Software Foundation","versions":[{"lessThan":"24.09.08","status":"affected","version":"0","versionType":"semver"}]}],"cveId":"CVE-2026-100168","cwes":["CWE-425"],"description":"Direct Request ('Forced Browsing') in the Content Manager component in Apache OFBiz 24.09.07 on all platforms allows an authenticated user holding only view-only content permissions (OFBTOOLS_VIEW and CONTENTMGR_VIEW) to re-parent content associations they do not own or manage via a direct POST request to the moveContentJson endpoint, which performs no permission check, unlike the equivalent updateContent/createContentAssoc/removeContentAssoc services that require genericContentPermission UPDATE. Users are recommended to upgrade to version 24.09.08, which fixes this issue.","epss":null,"exploits":[],"kev":null,"metrics":[],"modifiedAt":1793886244907,"publishedAt":1793886244907,"references":[{"source":"CNA: apache","tags":["vendor-advisory"],"url":"https://lists.apache.org/thread.html/7b2syzksp7klt9fvhdg0olldvs2g83lz"}],"remediation":[],"revision":"17132bb2d8714dd916b6a72ce4a42c48a1f45eb4db1a02e433d3f6a8b2928c6f","sources":[{"modifiedAt":1793886244907,"name":"CNA: apache","retrievedAt":1793887720793,"url":"https://www.cve.org/CVERecord?id=CVE-2026-100168"}],"ssvc":null,"status":"published","title":"Apache OFBiz: Missing Authorization vulnerability","updatedAt":1793887720793}