Overview
CVE-2026-71901 is an Improper Control of Resource Identifiers ("Resource Injection") vulnerability in Apache OFBiz. It was published to the NVD on November 5, 2026, with a CVSS score of 8.1.
An authenticated user with access to the sfa component can override the service used during vCard import and invoke other services that they should not be able to reach.
Affected Versions
| Product | Affected | Fixed |
|---|---|---|
| Apache OFBiz | All versions before 24.09.08 | 24.09.08 |
Technical Summary
The vCard import function in the sfa component takes the name of the service to run from the request. That value is not restricted, so an authenticated user can substitute a different service. Impact depends on which services are exposed and what the attacker's account can already do. Reaching an unintended service may allow actions beyond the user's permissions.
Exploitation requires an authenticated account with sfa access. No exploitation in the wild is reported in the source data. OFBiz has been a recurring target, and another OFBiz RCE was covered in a ThreatsDay bulletin on November 5, so prompt patching is advisable.
Remediation
- Upgrade Apache OFBiz to 24.09.08 or later.
- Restrict access to the sfa component to users who need it until you can patch.
- Review accounts with sfa permissions and remove unused ones.
- Audit logs for vCard import requests carrying unexpected service names.
- Keep OFBiz off the public internet where possible; place it behind a VPN or reverse proxy with authentication.