This vulnerability is an improper control of resource identifiers that allows an authenticated user with access to the SFA component to override the service invoked during vcard import and gain access to other internal services. The flaw permits arbitrary execution of internal services, potentially enabling the execution of sensitive operations or compromising data integrity. It is classified under CWE‑99.

All Apache OFBiz installations released before version 24.09.08 are affected. The vulnerability resides in the SFA component, which is present in standard OFBiz deployments. Users with login credentials that grant access to the SFA module are at risk.

Exploit requires a valid authenticated session that can reach the SFA component; no publicly known exploits are documented, and the vulnerability is not listed in CISA’s KEV catalog. The CVSS score is not provided, but the ability to invoke arbitrary internal services suggests a high severity. The EPSS score is not available, so the likelihood of exploitation is uncertain, but insiders or compromised credentials could abuse the flaw to execute privileged operations.