Authenticated users with minimal Order Manager privileges can exploit a flaw in the createReturnItem service to bind an OrderItem belonging to another party to a ReturnItem they control. This enables the user to link external order data to their own return records, potentially creating false returns, manipulating financial data, and gaining unauthorized insight into another party’s orders. The weakness allows a direct bypass of normal access control checks (CWE-639).

All installations of Apache OFBiz version 24.09 prior to 24.09.08, regardless of operating platform, are affected. The vulnerability applies to the Order Returns functionality exposed via the createReturnItem service.

Because the attack requires only authenticated access with standard Order Manager roles, the barrier to exploitation is low. No exploitation probability score is available, and the vulnerability has not been listed in the CISA KEV catalog. The potential impact—unauthorized data association and financial manipulation—makes it a high‑risk issue for any system exposing OFBiz’s return services to users with limited privileges.