Apache
CVE-2026-71901: Improper Control of Resource Identifiers ('Resource Injection') vulnerability in Apache OFBiz. An authenticate user with access to sfa component can override
CVE-2026-71901 Nov 5, 2026 Source: Vendor
Improper Control of Resource Identifiers ('Resource Injection') vulnerability in Apache OFBiz.
An authenticate user with access to sfa component can override the service to use on vcard import and access to other service.
This issue affects Apache OFBiz: before 24.09.08.
Users are recommended to upgrade to version 24.09.08, which fixes the issue.
Source of record
The credited names below are quoted verbatim from the vendor's own advisory:
https://nvd.nist.gov/vuln/detail/CVE-2026-71901
Are you credited here? Sign in to claim your line. It is yours immediately, with no review queue. The name the vendor printed stays next to your handle for anyone to check against the advisory above, and any member who thinks a claim is wrong can refute it.
Credited
2 lines
Showing 1–2 of 2 matching , clear filters
CVE-2026-71901
BR2026-0000-042593
unclaimed
Credited as Charles Vosburgh
CVE-2026-71901
BR2026-0000-042594
unclaimed
Credited as Bartlomiej Dmitruk at striga.ai