A direct POST request to the moveContentJson endpoint in the OFBiz 24.09.07 Content Manager allows an authenticated user with only view permissions (OFBTOOLS_VIEW and CONTENTMGR_VIEW) to re-parent content associations they do not own. The endpoint performs no permission check, unlike the equivalent services that require genericContentPermission UPDATE, so the flaw provides a form of privilege escalation that can alter the content structure, potentially affecting confidentiality and integrity.

The vulnerability exists in all platforms running Apache OFBiz 24.09.07. Users running this release are affected and are advised to upgrade to 24.09.08, which contains the fix.

Although a CVSS score is not provided and the EPSS score is unavailable, the presence of an unchecked permission check indicates a high severity flaw. The likely attack vector is a direct HTTP POST over an authenticated session, and the exploitation does not require any privileged account beyond an ordinary view‑only user. The flaw is not listed in the CISA KEV catalog, but it remains a critical privilege escalation risk.