# CVE-2026-92887: Apache OFBiz REST API authentication bypass in ModelApiReader

Source: https://junglewise.ai/threats/cve-2026-92887-incorrect-default-value-in-the-rest-api-framework-s-rest-xml  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-05. Updated: 2026-11-05  
License: CC BY 4.0 with a link back

CVE-2026-92887 · Severity: info · Published 2026-11-05

Apache OFBiz is a business management software framework that provides REST API functionality. A flaw in how the REST API framework parses configuration files causes it to incorrectly allow unauthenticated access to API operations when the configuration omits authentication requirements, treating missing authentication directives as disabled rather than required by default. This could allow attackers to invoke sensitive business operations without valid credentials.

Technologies: [Apache OFBiz](https://junglewise.ai/threats/technologies/ofbiz). Vendors: [Apache](https://junglewise.ai/threats/vendors/apache).

## Quick answers

**Is CVE-2026-92887 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-92887 being exploited in the wild.

**How severe is CVE-2026-92887?** Informational severity, published 5 November 2026.

**Which products and versions are affected?** Apache OFBiz through 24.09.07.

**Is there a fix for CVE-2026-92887?** Yes: fixed in 24.09.08. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-92887 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-92887?** Check whether you run Apache OFBiz at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 24.09.08

## Technical details

The ModelApiReader component of OFBiz's REST API framework incorrectly resolves a missing auth attribute in .rest.xml definition files to false instead of the correct default of true, as specified by the rest-api.xsd schema. This allows a remote, unauthenticated attacker to invoke REST API operations by crafting requests to .rest.xml resources or operations that lack the auth attribute, bypassing intended authentication controls.

## Affected products

- Apache OFBiz through 24.09.07

## Timeline

- 2026-11-05: disclosed
- 2026-11-05: advisory

## References

- [https://lists.apache.org/thread.html/7b2syzksp7klt9fvhdg0olldvs2g83lz](https://lists.apache.org/thread.html/7b2syzksp7klt9fvhdg0olldvs2g83lz)

## Related threats

- [Apache OFBiz improper authorization in ContentWorker](https://junglewise.ai/threats/cve-2026-82894-improper-authorization-in-contentworker-in-apache-ofbiz-24-09)
- [Apache OFBiz server-side request forgery in SurveyWrapper](https://junglewise.ai/threats/cve-2026-81828-server-side-request-forgery-in-surveywrapper-in-apache-ofbiz-24)
- [Apache OFBiz XXE injection in ContentWorker](https://junglewise.ai/threats/cve-2026-81816-xml-external-entity-xxe-injection-in-contentworker-in-apache)
- [Apache OFBiz SQL injection in performFind service](https://junglewise.ai/threats/cve-2026-81815-sql-injection-in-the-entity-engine-s-generic-performfind-service)
- [Apache OFBiz missing authorization in ProductSearchEvents](https://junglewise.ai/threats/cve-2026-81808-missing-authorization-in-productsearchevents-in-apache-ofbiz-24)