Improper access control in Apache OFBiz allows attackers to exploit the program export feature in multi‑tenant deployments to obtain confidential data belonging to other tenants. The flaw arises because the export API does not enforce tenant boundaries, leading to unauthorized data disclosure. The vulnerability is classified as CWE‑284. It is inferred that the vulnerability can be exploited by sending a request to the export endpoint over the network, typically via an authenticated web session belonging to a tenant user.

Apache OFBiz supplied by the Apache Software Foundation. All releases older than 24.09.06 that deploy the program export feature in a multi‑tenant configuration are affected.

The vulnerability has not been listed in CISA KEV and no EPSS score is available, so the current exploitation probability is unknown. The cross‑tenant data exposure indicates potential confidentiality loss if exploited. Because no public exploit has been disclosed, the risk assessment remains dependent on the sensitivity of data stored in each tenant, but the flaw is considered high risk for environments that rely on strict tenant isolation.