Direct request, also known as forced browsing, allows an attacker who only has view access to the Order Manager in Apache OFBiz to change the shipment tracking number on any order. The vulnerability is not an arbitrary code execution flaw; it simply lets an authenticated but low‑privileged user alter a data field that may be used for customer notifications, audit compliance, and fraud detection. The primary impact is a breach of data integrity and potential for financial or reputational damage.

All platforms running Apache OFBiz version 24.09 prior to 24.09.08 are susceptible, regardless of the underlying operating system or database. Users of the Order component in these releases should verify their installed version against the corrected 24.09.08 release.

The vulnerability requires the attacker to be authenticated with only view rights, a privilege that is commonly granted. No remote code execution or privilege escalation is possible, but the ability to modify tracking numbers can be leveraged for fraudulent returns, service delays, or data tampering. The EPSS score is not available, and the flaw is not listed in the CISA KEV catalog, suggesting that widespread exploitation has not yet been observed, but the attack vector is straightforward and could be automated if an actor has the minimal credentials.