The vulnerability resides in the Order Manager component of Apache OFBiz 24.09 before 24.09.08. An authenticated user who holds only the ORDERMGR_VIEW permission is incorrectly allowed to invoke the updateShipGroupShipInfo and appendOrderItem services on approved orders. This permits the user to change a ship group's shipping address, alter the shipment method, or append items with price overrides. The result is a breach of integrity that can be used to manipulate order fulfillment and billing. The weakness is classified as CWE‑266 – Improper Privilege Assignment.

Apache OFBiz distributed by the Apache Software Foundation. Versions 24.09 through the last minor release before 24.09.08 on all supported platforms are affected. The fix is present in version 24.09.08 and later.

The risk for environments that expose the Order Manager services is significant because the attacker does not need elevated meaning; any user with view rights can exploit the flaw. Since the EPSS score is not available and the vulnerability is not listed in CISA's KEV catalog, the likelihood of exploitation is not quantified, but the potential impact is high given the wide spread of view permissions across organization. The vulnerability is not remote only; it requires authentication, but such credentials are typically easy to obtain in internal networks. The attack vector is through the exposed services updateShipGroupShipInfo and appendOrderItem.