CVE-2026-71901

EUVD-2026-117495
Improper Control of Resource Identifiers ('Resource Injection') vulnerability in Apache OFBiz.



An authenticate user with access to sfa component can override the service to use on vcard import and access to other service.



This issue affects Apache OFBiz: before 24.09.08.



Users are recommended to upgrade to version 24.09.08, which fixes the issue.
Resource Injection
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
apacheCNA
8.1 HIGH
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources (CNA/ADP records, vendor advisories, Enginsight analysis).
VendorProductVersionSource
apacheofbiz
𝑥
< 24.9.8
CNA
Common Weakness Enumeration
Vulnerability Media Exposure
References
https://lists.apache.org/thread.html/7b2syzksp7klt9fvhdg0olldvs2g83lz