The vulnerability is an improper input validation flaw that allows an attacker to override JSON attributes and bypass the URL allowlist, leading to remote code execution. This weakness is classified as CWE-20. Successful exploitation would let the attacker execute arbitrary code, fully compromising confidentiality, integrity, and availability of the affected system.

The flaw exists in Apache OFBiz prior to configuration release 24.09.06. Only those installations running an earlier version are vulnerable; all newer releases contain the fix.

The CVSS score is not provided, and no EPSS data is available. The vulnerability is not listed in CISA KEV. Based on the description, the likely attack vector is remote, where an attacker sends a crafted JSON payload or HTTP request to the vulnerable endpoint; no privileged access is required.