The flaw is an authorization bypass that lets an authenticated user who only has view‑level order permissions modify or create OrderPaymentPreference records for orders outside their authorized scope. By supplying an orderPaymentPreferenceId belonging to a different order to the updateOrderPaymentPreference service, the attacker can change payment methods or add new preferences, enabling payment fraud or unauthorized financial changes. The impact is a direct compromise of payment data integrity.

The vulnerability is present in Apache OFBiz’s Order Manager component on version 24.09.07 on all supported platforms. All users of that release should upgrade to 24.09.08 or later, which contains the fix. No other versions are explicitly listed as affected.

The exploitation path requires an authenticated account with at least view‑level order rights; no elevated privileges are needed. The advisory does not provide a CVSS score or EPSS value, and the flaw is not yet in CISA’s KEV catalog, so the exact likelihood cannot be quantified. However, a legitimate user can trivially invoke the service and alter payment data, making the risk moderate but significant for organizations relying on OFBiz for order processing.