CVE-2026-84728

Incorrect Authorization in Apache OFBiz 
24.09 before 24.09.08 on all platforms, when documented multitenancy is 
enabled, allows a remote authenticated attacker holding only a valid 
low-privilege account in one tenant to read and write data belonging to a
 different tenant, by submitting their own tenant's userTenantId 
alongside their own credentials to the normal Party Manager login 
against a hostname mapped to a different tenant: ContextFilter resolves 
the tenant from the hostname via TenantDomainName, but LoginWorker gives
 priority to the conflicting userTenantId request parameter and 
authenticates against the attacker's own tenant, so a subsequent 
ordinary request to the same hostname combines the hostname-mapped 
tenant's Entity Engine delegator with the attacker's tenant's session 
dispatcher, security object, and identity, letting the permission check 
run against the attacker's own tenant while the resulting read or write 
is performed against the hostname-mapped tenant's data. Users are 
recommended to upgrade to version 24.09.08, which fixes this issue.