CVSS 7.3 (high) · published 2026-11-05
Incorrect default value in the REST API framework's .rest.xml definition parser (ModelApiReader) in Apache OFBiz through 24.09.07 on all platforms allows a remote, unauthenticated attacker to invoke a REST API operation without providing valid credentials via a .rest.xml resource or operation definition that omits the auth attribute, which ModelApiReader incorrectly resolves to false instead of the true default declared by rest-api.xsd. Users are recommended to upgrade to version 24.09.08, which fixes this issue.
Affected products (NVD): apache ofbiz
Fixed in (NVD): 24.09.08
Weakness: CWE-306, CWE-1188
Source: NVD CVE-2026-92887
Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.