{"id":"CVE-2026-82912","published":"2026-11-05T14:17:06.200","lastModified":"2026-11-06T05:18:33.500","description":"Improper Neutralization of Special Elements Used in an Expression Language Statement ('Expression Language Injection') in EmailServices in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote authenticated attacker holding only OFBTOOLS_VIEW and ACCOUNTING_VIEW, the two view-level permissions that open the Accounting application, to execute arbitrary operating system commands as the account running OFBiz, by submitting a ${groovy:...} expression as the bodyText or subject value to the shipped Send Per Email invoice form, because sendMailFromScreen passes those caller-supplied values through FlexibleStringExpander.expandString, which compiles and evaluates embedded Groovy on a class loader that carries none of the SecureASTCustomizer restrictions GroovyUtil.eval applies elsewhere, behind a service and request-map that declare no permission check beyond base authentication. Users are recommended to upgrade to version 24.09.08, which fixes this issue.","cvssScore":8.8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-917"],"vendors":[],"products":[],"references":[{"url":"https://lists.apache.org/thread.html/7b2syzksp7klt9fvhdg0olldvs2g83lz","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"Expression Language Injection in Apache OFBiz allows authenticated attackers with minimal permissions to execute arbitrary Groovy code via crafted email fields, leading to full system compromise.","exploitability":"Requires authentication with only OFBTOOLS_VIEW and ACCOUNTING_VIEW permissions; no special privileges or complex conditions needed.","blast_radius":"Attackers can execute arbitrary OS commands as the OFBiz service account, risking full server compromise, data exfiltration, and lateral movement.","remediation":"Upgrade to Apache OFBiz version 24.09.08 immediately.","detection":"Monitor for requests to the Send Per Email invoice form with bodyText or subject parameters containing ${groovy:...} expressions in web server or application logs.","tags":["el-injection","rce","groovy","ofbiz","auth-bypass"],"model":"garnet-coder","analyzedAt":"2026-11-06T09:52:58.802Z"}}