Missing Authorization Affecting org.omnifaces:omnifaces package, versions [,1.14.3)[2.0-RC1,2.7.33)[3.0-RC1,3.14.23)[4.0-M1,4.7.12)[5.0-M1,5.4.2)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-JAVA-ORGOMNIFACES-18313155
- published26 Jul 2026
- disclosed24 Jul 2026
- creditDaniel Birtwhistle
Introduced: 24 Jul 2026
New CVE NOT AVAILABLE CWE-345 (opens in a new tab)How to fix?
Upgrade org.omnifaces:omnifaces to version 1.14.3, 2.7.33, 3.14.23, 4.7.12, 5.4.2 or higher.
Overview
Affected versions of this package are vulnerable to Missing Authorization via the CombinedResourceInfo process. An attacker can cause excessive memory consumption and potentially exhaust server resources by submitting forged combined-resource IDs that inflate to large outputs and are cached without bounds. Additional attack vectors include bypassing resource boundaries to access raw content, triggering server-side requests to attacker-controlled hosts, polluting source-map caches, injecting unescaped values into Ajax callback scripts, and replaying push-channel messages to unauthorized clients by exploiting insufficient session binding.