The vulnerability arises from improper input validation in the Order Returns component of Apache OFBiz, allowing an authenticated user lacking ORDERMGR_CREATE permission to set any price on a return item. This bypasses the server‑computed price ceiling and can result in refunds that exceed legitimate amounts, directly undermining financial controls and potentially causing significant monetary loss.

Apache OFBiz version 24.09.07 on all supported platforms is affected. The issue is resolved in version 24.09.08, which is the recommended upgrade path.

The attack requires local authentication but does not depend on special privileges; any user who can invoke the createReturnItem service can exploit it. Although no EPSS score is reported and the vulnerability is not listed in CISA KEV, the potential for financial exploitation is high. The absence of an EPSS score conveys that current exploitation likelihood is uncertain, but the high impact warrants immediate attention.