CVE-2026-82960 — Apache OFBiz Widget use-when Expression Injection Bypasses Groovy Sandbox for Authenticated RCE

In the Apache OFBiz CMS plugin before version 24.09.08, the vulnerability allows a remote authenticated attacker with only CMS content-editor access to execute arbitrary operating system commands as the OFBiz process user.