CVE-2026-82912 — Apache OFBiz: unsandboxed Groovy compiled from a service parameter

A vulnerability in Apache OFBiz EmailServices before version 24.09.08, on all platforms, allows a remote authenticated attacker with only the OFBTOOLS_VIEW and ACCOUNTING_VIEW permissions to execute arbitrary operating system commands as the account running OFBiz.