# CVE-2026-84728: Apache OFBiz: Cross-tenant authorization bypass in mapped-domain login

Status: published. Published: 2026-11-05. Updated: 2026-11-05.

Incorrect Authorization in Apache OFBiz 
24.09 before 24.09.08 on all platforms, when documented multitenancy is 
enabled, allows a remote authenticated attacker holding only a valid 
low-privilege account in one tenant to read and write data belonging to a
 different tenant, by submitting their own tenant's userTenantId 
alongside their own credentials to the normal Party Manager login 
against a hostname mapped to a different tenant: ContextFilter resolves 
the tenant from the hostname via TenantDomainName, but LoginWorker gives
 priority to the conflicting userTenantId request parameter and 
authenticates against the attacker's own tenant, so a subsequent 
ordinary request to the same hostname combines the hostname-mapped 
tenant's Entity Engine delegator with the attacker's tenant's session 
dispatcher, security object, and identity, letting the permission check 
run against the attacker's own tenant while the resulting read or write 
is performed against the hostname-mapped tenant's data. Users are 
recommended to upgrade to version 24.09.08, which fixes this issue.

## Remediation

No remediation reported in collected sources

## Affected products and versions

- Apache Software Foundation / Apache OFBiz: ≥ 0; < 24.09.08 (affected, semver). Source: CNA: apache

## Severity and prioritization

- CVSS 3.1: 5.4 (medium); CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N; source: ADP: CISA-ADP

- CISA KEV: No listing in collected sources

- EPSS: Not available

- SSVC: exploitation none; automatable no; technical impact partial; source ADP: CISA-ADP

- Weaknesses: CWE-863

## Exploit evidence

No exploit evidence in collected sources. This is not proof of no exploitation.

## References

- https://lists.apache.org/thread.html/7b2syzksp7klt9fvhdg0olldvs2g83lz (CNA: apache; vendor-advisory)

## Provenance

- CNA: apache: https://www.cve.org/CVERecord?id=CVE-2026-84728; retrieved 2026-11-05; source updated 2026-11-05

Revision: 0726aa69a2621e6871e6f1781cd9e3753cd6afef6344243b37e3ff18d9219aa5

Canonical: https://y2.dev/cve/CVE-2026-84728

## Agent and API access

Public CVE pages, Markdown, and JSON are free to read without an account or API key.

- Public catalog: https://y2.dev/cve/index.json. Follow nextCursor with the same search, filters, sort, and limit (1–100). A null cursor marks the end.

- WebMCP: search_cve_disclosures, get_cve_disclosure, get_cve_page_markdown, get_y2_cve_access. Available in compatible browsers.

- Cyber API: https://api.y2.dev/api/v2/cyber/cves and https://api.y2.dev/api/v2/cyber/cves/{cveId}.

- Y2 Pro or Elite: create a workspace API key with the intel:cyber scope and send Authorization: Bearer <Y2_API_KEY>. Setup: https://y2.dev/docs/api/create-key.

- x402: Pay per request without an account or API key. Omit Authorization, read the HTTP 402 PAYMENT-REQUIRED challenge, validate its current requirements, and retry with PAYMENT-SIGNATURE through an authorized payment client. These browser tools never make payments. Guide: https://y2.dev/docs/api/x402.

- OpenAPI: https://y2.dev/api/openapi.yaml. Agent access metadata: https://y2.dev/cve/agent.json.

Collected public records only. Check source status for coverage and freshness.