Low Severity
CVE-2026-82894
Published: Nov 12, 2026
Proof-of-concept exploits for seven Apache OFBiz vulnerabilities reported in 2026, all fixed in Apache OFBiz 24.09.08. CVE-2026-73577, CVE-2026-73578, CVE-2026-82894, CVE-2026-83538, CVE-2026-83542, CVE-2026-84183, CVE-2026-48728
# Apache OFBiz 2026 PoCs
Proof-of-concept scripts accompanying seven Apache OFBiz writeups reported in August 2026, all fixed in Apache OFBiz 24.09.08.
| Script | CVE | Finding | Access | Severity | Writeup |
| --- | --- | --- | --- | --- | --- |
| [`cve_2026_73577.py`](cve_2026_73577.py) | CVE-2026-73577 | Path-suffix view authorization bypass to RCE | Unauthenticated | Important | [Writeup](https://cryptocat.me/blog/research/analysis/cve_2026_73577/) |
| [`cve_2026_73578.py`](cve_2026_73578.py) | CVE-2026-73578 | Saved-view authorization bypass to RCE | Unauthenticated | Important | [Writeup](https://cryptocat.me/blog/research/analysis/cve_2026_73578/) |
| [`cve_2026_82894.py`](cve_2026_82894.py) | CVE-2026-82894 | `showHelpPublic` private Content disclosure (advisory covers the `Content.serviceName` service-invocation root) | Unauthenticated read; CONTENTMGR_CREATE/UPDATE to arm the service root | Important | [Writeup](https://cryptocat.me/blog/research/analysis/cve_2026_82894/) |
| [`cve_2026_83538.py`](cve_2026_83538.py) | CVE-2026-83538 | Unauthenticated disclosure via HR, Catalog and Order Manager helper routes | Unauthenticated | Moderate | [Writeup](https://cryptocat.me/blog/research/analysis/cve_2026_83538/) |
| [`cve_2026_83542.py`](cve_2026_83542.py) | CVE-2026-83542 | Widget-resource injection RCE | Unauthenticated | Critical | [Writeup](https://cryptocat.me/blog/research/analysis/cve_2026_83542/) |
| [`cve_2026_84183.py`](cve_2026_84183.py) | CVE-2026-84183 | Content Manager VIEW-only RCE via `updateLayout` | OFBTOOLS_VIEW + CONTENTMGR_VIEW | Important | [Writeup](https://cryptocat.me/blog/research/analysis/cve_2026_84183/) |
| [`cve_2026_84728.py`](cve_2026_84728.py) | CVE-2026-84728 | Cross-tenant authorization bypass in mapped-domain login | Low-privilege account in any tenant | Important | [Writeup](https://cryptocat.me/blog/research/analysis/cve_2026_84728/) |
Each script needs Python 3 and `requests` (`pip install requests`), writes coloured p