CVE-2024-38856 Apache OFBiz Incorrect Authorization

Exploited in the wild High 8.1 Published 5 Aug 2024 Updated 21 Oct 2025

Unauthenticated attackers can execute screen rendering code in Apache OFBiz if specific screen definitions lack explicit permission checks.

Exploited in the wild: Since 27 Aug 2024
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2024-38856?

CVE-2024-38856 is a high-severity missing authorization vulnerability in Apache Ofbiz, published on 5 Aug 2024. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Incorrect Authorization vulnerability in Apache OFBiz.

This issue affects Apache OFBiz: through 18.12.14.

Users are recommended to upgrade to version 18.12.15, which fixes the issue.

Unauthenticated endpoints could allow execution of screen rendering code of screens if some preconditions are met (such as when the screen definitions don't explicitly check user's permissions because they rely on the configuration of their endpoints).

Weakness: CWE-863

Which versions are affected by CVE-2024-38856?

It affects 1 product.

Products include Apache Ofbiz.

How do I fix CVE-2024-38856?

No fix has been published for CVE-2024-38856 yet. Limit exposure of the affected software until one is available. US federal agencies must fix it by 17 Sep 2024.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2024-38856 being exploited?

Yes. Attackers have exploited CVE-2024-38856 in the wild since at least 27 Aug 2024.

Public exploit code: 1 Metasploit module, 1 Nuclei template and 9 proofs of concept on GitHub.

All Apache Ofbiz vulnerabilities

Sources

Also known as GHSA-gp2r-34c8-48xq.