This vulnerability allows an unauthenticated actor to retrieve shipment label images stored within Apache OFBiz. The image data can contain sensitive information such as customer details, stock information, or tracking information, compromising confidentiality. The flaw is a classic case of information disclosure (CWE-200).

Affected systems are installations of Apache OFBiz before version 24.09.06 deployed by organizations using the platform. The vulnerability is present in all prior releases, regardless of deployment size or usage scenario.

The public EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog. No CVSS score is reported, but the flaw requires only unauthenticated HTTP access to a known endpoint, implying that any network location that can reach the OFBiz instance can exploit it. The lack of authentication checks represents a high exploitation potential for exposed instances, making patching critical.