Apache OFBiz 24.09 pre‑24.09.08 has a missing authorization enforcement in RequestHandler.renderView. An attacker can supply a crafted _LAST_VIEW_NAME_ that is stored as a saved‑view in an anonymous session and later rendered without re‑applying the view’s original authentication rule, exposing protected UI pages and associated business data. The vulnerability is classified as Unauthorized Access (CWE‑288).

The affected product is Apache OFBiz 24.09 prior to 24.09.08 on all operating platforms. Any installation of these versions is vulnerable.

Exploitation requires only the ability to send HTTP requests to the application; no user credentials are needed. The EPSS score is unavailable, and the vulnerability is not listed in the CISA KEV catalog, yet the combination of unauthenticated access to protected resources suggests a high severity risk. The likely attack vector is remote web‑application interaction where the attacker crafts and submits a request containing a malicious _LAST_VIEW_NAME_ value.