Description
Incorrect default value in the REST API framework's .rest.xml definition parser (ModelApiReader) in Apache OFBiz through 24.09.07 on all platforms allows a remote, unauthenticated attacker to invoke a REST API operation without providing valid credentials via a .rest.xml resource or operation definition that omits the auth attribute, which ModelApiReader incorrectly resolves to false instead of the true default declared by rest-api.xsd.

Users are recommended to upgrade to version 24.09.08, which fixes this issue.
Published: 2026-11-05
Score: n/a
EPSS: n/a
KEV: No
Impact: Unauthenticated REST API access
Action: Patch Immediately
AI Analysis

Impact

A flaw in the ModelApiReader parser for Apache OFBiz REST definition files treats an absent auth attribute as false instead of the intended true default. As a result, callers can issue REST operations without presenting valid credentials, enabling a remote attacker to trigger any operation exposed by .rest.xml files. This bypass can lead to unauthorized data manipulation or retrieval, depending on the API’s capabilities.

Affected Systems

Apache Software Foundation’s Apache OFBiz, all platform builds, versions up to and including 24.09.07 are affected.

Risk and Exploitability

The vulnerability has no documented EPSS score and is not listed in the CISA KEV catalog. Its effect is a remote unauthenticated authentication bypass, which requires only an HTTP request to a target OFBiz instance. Because no other prerequisites are mentioned, any user with network connectivity to the service can exploit it. The precise CVSS score is not disclosed, but the potential for unauthorized API use represents a serious security risk.

Generated by OpenCVE AI on November 5, 2026 at 15:40 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Apache OFBiz to version 24.09.08, which corrects the default auth handling in ModelApiReader
  • Review existing .rest.xml configuration files and add auth="true" to any operation that requires authentication
  • Configure the OFBiz REST framework to enforce authentication by default if an auth attribute is missing, if the version supports this setting

Generated by OpenCVE AI on November 5, 2026 at 15:40 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 05 Nov 2026 16:30:00 +0000

Type Values Removed Values Added
First Time appeared Apache
Apache ofbiz
Apache Software Foundation
Apache Software Foundation apache Ofbiz
Vendors & Products Apache
Apache ofbiz
Apache Software Foundation
Apache Software Foundation apache Ofbiz

Thu, 05 Nov 2026 14:00:00 +0000

Type Values Removed Values Added
Description Incorrect default value in the REST API framework's .rest.xml definition parser (ModelApiReader) in Apache OFBiz through 24.09.07 on all platforms allows a remote, unauthenticated attacker to invoke a REST API operation without providing valid credentials via a .rest.xml resource or operation definition that omits the auth attribute, which ModelApiReader incorrectly resolves to false instead of the true default declared by rest-api.xsd. Users are recommended to upgrade to version 24.09.08, which fixes this issue.
Title Apache OFBiz: REST API authentication bypassed by default when the auth attribute is omitted from a .rest.xml operation
Weaknesses CWE-1188
CWE-306
References

Subscriptions

Apache Ofbiz
Apache Software Foundation Apache Ofbiz
cve-icon MITRE

Status: PUBLISHED

Assigner: apache

Published:

Updated: 2026-11-05T13:45:53.657Z

Reserved: 2026-09-17T08:53:18.206Z

Link: CVE-2026-92887

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-11-05T14:17:07.347

Modified: 2026-11-05T14:48:26.210

Link: CVE-2026-92887

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-11-05T16:00:18Z

Weaknesses
  • CWE-1188

    Initialization of a Resource with an Insecure Default

  • CWE-306

    Missing Authentication for Critical Function