Apache OFBiz’s RequestHandler incorrectly authorizes requests that include a protected view name as a path suffix of a public endpoint. A remote attacker can append the protected view to a public URL, causing the servlet to authorize based on the public portion while rendering the protected view. This bypass permits unauthenticated access to resources that should be restricted, potentially exposing confidential data or allowing malicious modifications—an example of an authorization bypass flaw (CWE‑288).

All installations of Apache OFBiz version 24.09 and earlier across all supported operating systems are affected. The problem resides in the RequestHandler component of OFBiz 24.09 prior to the 24.09.08 update. Users running earlier releases without applying the patch remain vulnerable.

The flaw can be exercised with a simple HTTP request from any host, making the attack vector network accessible and the exploitation risk high. Because no credentials are required, an attacker can gain unauthorized access to sensitive application areas. No published exploits are known, but the absence of an EPSS score does not reduce the inherent threat, and the vulnerability is not yet listed in the CISA KEV catalog. The weak authorization control warrants prompt remedial action.