CVE-2026-81744

Incorrect Authorization in ContentPermissionServices in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote authenticated attacker holding only a limited content-create permission to self-grant the OWNER role on arbitrary content by invoking the createContentRole service (e.g. via the createForumGroupRole request), causing the permission check to fall through to a fail-open default-grant branch when no ContentPurposeOperation entry matches the requested operation and content purpose, rather than denying the request. A self-granted OWNER role then satisfies the ownership check used to authorize update, removal, and status changes on that content, giving the attacker full read/write/delete control over content they should not have access to. Users are recommended to upgrade to version 24.09.08, which fixes this issue.

• CWE-862

• https://lists.apache.org/thread.html/7b2syzksp7klt9fvhdg0olldvs2g83lz

Published

Nov 5, 2026

Last Modified

Nov 6, 2026

Status

Awaiting Analysis

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-81739The Paytm Payment Gateway WordPress plugin before 2.8.9 does…7.5
• CVE-2026-8174Zohocorp Zoho Mail wordpress plugin is vulnerable to Cross-S…5.7
• CVE-2026-81740The Paytm Payment Gateway WordPress plugin before 2.8.9 does…5.3
• CVE-2026-81741The Groundhogg — CRM, Newsletters, and Marketing Automation …4.7
• CVE-2026-81742The BE REST Endpoints WordPress plugin through 1.0.0 does no…8.8
• CVE-2026-81743Affected versions of Flowintel allow the LOG_FILE configurat…7.5
• CVE-2026-8175IBM Aspera High-Speed Transfer Endpoint 3.7.4 through 4.4.7 …9.8
• CVE-2026-81753Affected versions of Flowintel render Mermaid blocks contain…5.1
• CVE-2026-81754The Vigilant – 100% Free Security Suite: Firewall, 2FA, Logi…7.2
• CVE-2026-81755Uncontrolled resource consumption in the streaming RPC compo…7.5
• CVE-2026-81756Unauthenticated SQL Injection in Smart Marketing SMS and New…9.3
• CVE-2026-81757Author Remote Code Execution (RCE) in Rank Math SEO <= 1.0.2…7.2