CVE-2026-71901: Apache OFBiz resource injection in SFA component

CVE-2026-71901 · Severity: info · Published 2026-11-05

Apache OFBiz is an open-source enterprise resource planning system. An authenticated user with access to the sales and force automation (SFA) component can manipulate resource identifiers to override which service is called during vCard import operations, potentially gaining access to other services they should not have permission to use.

Technologies: Apache OFBiz. Vendors: Apache.

Quick answers

Is CVE-2026-71901 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-71901 being exploited in the wild.
How severe is CVE-2026-71901?
Informational severity, published 5 November 2026.
Which products and versions are affected?
Apache OFBiz before 24.09.08.
Is there a fix for CVE-2026-71901?
Yes: fixed in 24.09.08. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-71901 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-71901?
Check whether you run Apache OFBiz at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • Fixed in: 24.09.08

Technical details

This is a resource injection vulnerability in the vCard import functionality of the OFBiz SFA module. An authenticated attacker with SFA component access can override service identifiers to call unintended services during the import process. The vulnerability requires prior authentication and component-level access.

Affected products

  • Apache OFBiz before 24.09.08

Timeline

  • 2026-11-05: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.