{"affected":[{"defaultStatus":"unaffected","product":"Apache OFBiz","source":"CNA: apache","vendor":"Apache Software Foundation","versions":[{"lessThan":"24.09.08","status":"affected","version":"0","versionType":"semver"}]}],"cveId":"CVE-2026-84728","cwes":["CWE-863"],"description":"Incorrect Authorization in Apache OFBiz \n24.09 before 24.09.08 on all platforms, when documented multitenancy is \nenabled, allows a remote authenticated attacker holding only a valid \nlow-privilege account in one tenant to read and write data belonging to a\n different tenant, by submitting their own tenant's userTenantId \nalongside their own credentials to the normal Party Manager login \nagainst a hostname mapped to a different tenant: ContextFilter resolves \nthe tenant from the hostname via TenantDomainName, but LoginWorker gives\n priority to the conflicting userTenantId request parameter and \nauthenticates against the attacker's own tenant, so a subsequent \nordinary request to the same hostname combines the hostname-mapped \ntenant's Entity Engine delegator with the attacker's tenant's session \ndispatcher, security object, and identity, letting the permission check \nrun against the attacker's own tenant while the resulting read or write \nis performed against the hostname-mapped tenant's data. Users are \nrecommended to upgrade to version 24.09.08, which fixes this issue.","epss":null,"exploits":[],"kev":null,"metrics":[{"score":5.4,"severity":"medium","source":"ADP: CISA-ADP","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","version":"3.1"}],"modifiedAt":1793893931192,"publishedAt":1793887022134,"references":[{"source":"CNA: apache","tags":["vendor-advisory"],"url":"https://lists.apache.org/thread.html/7b2syzksp7klt9fvhdg0olldvs2g83lz"}],"remediation":[],"revision":"0726aa69a2621e6871e6f1781cd9e3753cd6afef6344243b37e3ff18d9219aa5","sources":[{"modifiedAt":1793893931192,"name":"CNA: apache","retrievedAt":1793895390134,"url":"https://www.cve.org/CVERecord?id=CVE-2026-84728"}],"ssvc":{"assessedAt":1793893852995,"automatable":"no","exploitation":"none","source":"ADP: CISA-ADP","technicalImpact":"partial"},"status":"published","title":"Apache OFBiz: Cross-tenant authorization bypass in mapped-domain login","updatedAt":1793895390134}