CVE-2026-84728

*** Pendiente de traducción *** Incorrect Authorization in Apache OFBiz <br /> 24.09 before 24.09.08 on all platforms, when documented multitenancy is <br /> enabled, allows a remote authenticated attacker holding only a valid <br /> low-privilege account in one tenant to read and write data belonging to a<br /> different tenant, by submitting their own tenant&amp;#39;s userTenantId <br /> alongside their own credentials to the normal Party Manager login <br /> against a hostname mapped to a different tenant: ContextFilter resolves <br /> the tenant from the hostname via TenantDomainName, but LoginWorker gives<br /> priority to the conflicting userTenantId request parameter and <br /> authenticates against the attacker&amp;#39;s own tenant, so a subsequent <br /> ordinary request to the same hostname combines the hostname-mapped <br /> tenant&amp;#39;s Entity Engine delegator with the attacker&amp;#39;s tenant&amp;#39;s session <br /> dispatcher, security object, and identity, letting the permission check <br /> run against the attacker&amp;#39;s own tenant while the resulting read or write <br /> is performed against the hostname-mapped tenant&amp;#39;s data. Users are <br /> recommended to upgrade to version 24.09.08, which fixes this issue.