Description
Missing authorization check in the getHRChild service in Apache OFBiz through 24.09.07 on all platforms allows a remote unauthenticated attacker to recursively enumerate Human Resources organization and employee data, including department names and identifiers, employment position names and identifiers, employee party identifiers, position occupancy, and organization relationships, via a crafted partyId parameter. Users are recommended to upgrade to version 24.09.08, which fixes this issue.
Published: 2026-11-05
Score: n/a
EPSS: n/a
KEV: No
Impact: Information Disclosure
Action: Immediate Patch
AI Analysis

Impact

The vulnerable getHRChild service in Apache OFBiz lacks an authorization check, letting a remote, unauthenticated attacker recurse through Human Resources data by supplying a crafted partyId parameter. This enables disclosure of sensitive information such as department names, identifiers, employment positions, employee party identifiers, and organizational relationships, thereby violating confidentiality. The weakness maps to information exposure and authorization bypass.

Affected Systems

Apache Software Foundation’s Apache OFBiz products through version 24.09.07 on all platforms are affected. The issue is fixed in version 24.09.08.

Risk and Exploitability

Because authentication is not required, the attack vector is remote and straightforward. While an explicit CVSS score is not listed, the potential exposure of corporate HR data renders the risk high. EPSS data is unavailable, and the vulnerability is not in CISA’s KEV catalog.

Generated by OpenCVE AI on November 5, 2026 at 15:23 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Apache OFBiz to version 24.09.08 or later to apply the vendor fix.
  • Restrict or block access to the getHRChild endpoint for unauthenticated users until a patch is deployed.
  • Implement additional authorization checks for the partyId parameter to ensure only authenticated and authorized personnel can query HR information.

Generated by OpenCVE AI on November 5, 2026 at 15:23 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 05 Nov 2026 17:00:00 +0000

Type Values Removed Values Added
First Time appeared Apache
Apache ofbiz
Apache Software Foundation
Apache Software Foundation apache Ofbiz
Vendors & Products Apache
Apache ofbiz
Apache Software Foundation
Apache Software Foundation apache Ofbiz

Thu, 05 Nov 2026 14:30:00 +0000

Type Values Removed Values Added
Description Missing authorization check in the getHRChild service in Apache OFBiz through 24.09.07 on all platforms allows a remote unauthenticated attacker to recursively enumerate Human Resources organization and employee data, including department names and identifiers, employment position names and identifiers, employee party identifiers, position occupancy, and organization relationships, via a crafted partyId parameter. Users are recommended to upgrade to version 24.09.08, which fixes this issue.
Title Apache OFBiz: Unauthenticated HR organization and employee disclosure
Weaknesses CWE-200
CWE-862
References

Subscriptions

Apache Ofbiz
Apache Software Foundation Apache Ofbiz
cve-icon MITRE

Status: PUBLISHED

Assigner: apache

Published:

Updated: 2026-11-05T14:10:09.376Z

Reserved: 2026-08-13T07:26:39.294Z

Link: CVE-2026-73580

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-11-05T15:17:22.620

Modified: 2026-11-05T15:17:22.620

Link: CVE-2026-73580

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-11-05T16:45:06Z

Weaknesses
  • CWE-200

    Exposure of Sensitive Information to an Unauthorized Actor

  • CWE-862

    Missing Authorization