What is GHSA-m2j3-h9wr-6fv2?

GHSA-m2j3-h9wr-6fv2 is a security advisory published by GitHub Security Advisories with unknown severity. Missing authorization check in the getHRChild service in Apache OFBiz through 24.09.07 on all...

Which CVE IDs does GHSA-m2j3-h9wr-6fv2 cover?

GHSA-m2j3-h9wr-6fv2 covers the following CVE IDs: CVE-2026-73580. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

GHSA-m2j3-h9wr-6fv2unknown

Missing authorization check in the getHRChild service in Apache OFBiz through 24.09.07 on all...

Vendor

GitHub Security Advisories

Published

November 5, 2026

Last Modified

November 5, 2026

🔗 CVE IDs covered (1)

CVE-2026-73580 →

📋 Description

Missing authorization check in the getHRChild service in Apache OFBiz through 24.09.07 on all platforms allows a remote unauthenticated attacker to recursively enumerate Human Resources organization and employee data, including department names and identifiers, employment position names and identifiers, employee party identifiers, position occupancy, and organization relationships, via a crafted partyId parameter. Users are recommended to upgrade to version 24.09.08, which fixes this issue.

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-73580
https://lists.apache.org/thread.html/7b2syzksp7klt9fvhdg0olldvs2g83lz
https://github.com/advisories/GHSA-m2j3-h9wr-6fv2