Apache OFBiz Webtools allows users with minimal privileges to create and submit scheduled jobs to the system. Because the application fails to enforce proper authorization checks, an attacker can submit jobs that run under the system's service account, thereby executing arbitrary commands, accessing sensitive data, or disrupting service availability. The weakness is correctly categorized as Improper Authorization (CWE-285).

Any installation of Apache OFBiz older than version 24.09.06 is impacted. The vulnerability applies to all components exposed through the Webtools interface that enable job submission.

The CVSS score is 6.5, indicating moderate severity. The EPSS score is < 1%, suggesting low likelihood of exploitation, but the vulnerability still enables low‑privileged users to run system jobs. The issue is not reported in the CISA KEV catalog, yet it remains publicly documented by Apache and can be exploited by users who have authenticated to the platform but lack administrative rights.