BugRater
Early access. The directory is still filling out, and every rating here comes from a researcher's reported experience.

Security releases

Apache

CVE-2026-84728: Incorrect Authorization in Apache OFBiz 24.09 before 24.09.08 on all platforms, when documented multitenancy is enabled, allows a remote authenticated attacke

CVE-2026-84728 Nov 5, 2026 Source: Vendor

Incorrect Authorization in Apache OFBiz
24.09 before 24.09.08 on all platforms, when documented multitenancy is
enabled, allows a remote authenticated attacker holding only a valid
low-privilege account in one tenant to read and write data belonging to a
different tenant, by submitting their own tenant's userTenantId
alongside their own credentials to the normal Party Manager login
against a hostname mapped to a different tenant: ContextFilter resolves
the tenant from the hostname via Ten

Source of record The credited names below are quoted verbatim from the vendor's own advisory: https://nvd.nist.gov/vuln/detail/CVE-2026-84728
Are you credited here? Sign in to claim your line. It is yours immediately, with no review queue. The name the vendor printed stays next to your handle for anyone to check against the advisory above, and any member who thinks a claim is wrong can refute it.

Credited

1 line
All 1 CVEs 1 Additional recognition 0 Unclaimed only
Showing 1–1 of 1
CVE-2026-84728 BR2026-0000-042583 unclaimed
Credited as Jonah Burgess (CryptoCat)