This vulnerability allows an unauthenticated actor to retrieve shipment label images stored within Apache OFBiz. The exposure of these images can lead to a disclosure of sensitive information. The flaw is a classic case of information disclosure (CWE-200).

Affected systems are installations of Apache OFBiz before version 24.09.06 deployed by organizations using the platform. The vulnerability is present in all prior releases, regardless of deployment size or usage scenario.

The public EPSS score is < 1% and it is not listed in the CISA KEV catalog. The CVSS score is 7.5, indicating high severity. The vulnerability appears to require only unauthenticated HTTP access to a known endpoint, implying that any network location that can reach the OFBiz instance can exploit it; it is inferred rather than explicitly documented in the provided text. The lack of authentication checks represents a high exploitation potential for exposed instances, making patching critical.